Eleonora Cagli

Loïc Masure

Rémy Daudigny

Houssem Maghrebi

Annelie Heuser

Benoît Gérard

Pierre-Alain Moëllic

MSE Mean Square Error. 94

Keywords:

des personnes, avec qui, j'ai eu la chance d'échanger et/ou de rencontrer lors de conférences/workshops lorsque cela était encore possible. En particulier,

Trois ans. . . Cela fait maintenant trois ans que cette thèse a débuté, et, depuis son commencement, il me tarde de rédiger ces quelques lignes de remerciement, et de prendre le temps d'affirmer toute la reconnaissance que j'ai pour l'ensemble des personnes m'ayant accompagné, conseillé ou accordé du temps durant cette magnifique aventure.

Une thèse est faite de rencontre, et la plus importante fût certainement celle d'Alexandre Venelli. Cette histoire a débuté par un mail le 5 octobre 2017 à 14h12 lorsqu'il me répondait pour un entretien téléphonique de 30min suite à ma candidature de stage de fin d'étude. A l'époque, je n'imaginais pas l'impact que cette rencontre aurait 4 ans plus tard. A cette époque, ma formation ne laissait pas entrevoir une carrière en cryptographie et pourtant, il a su me faire confiance. Quelques mois plus tard, la même situation s'est présentée lorsqu'il fallait faire un choix pour la thèse, et, une nouvelle fois, il m'a accordé sa confiance alors que, sur le papier, mon profil n'était peut-être pas le plus adapté. C'est simple, s'il n'avait pas été là, je pense que je n'aurai jamais mis un pied dans la cryptographie (domaine qui s'est avéré ensuite être une véritable passion). Son engagement aurait pu s'arrêter là, mais non. Il m'a enseigné sa vision de la recherche où l'open source est un devoir pour tout scientifique (même si cela peut nous jouer des tours). Son esprit critique, sa volonté à toujours comprendre l'intérêt dans tout ce qu'il entreprend, et sa rigueur m'ont un peu plus nourri chaque jour. Il a su rendre cette expérience à la fois scientifiquement et humainement passionnante. Son soutien indéfectible, sa disponibilité sans faille (même dans les moments les plus difficiles), son honnêteté, sa fiabilité, sa patience, son humour et sa volonté de partager ses connaissances font de lui LE mentor dont j'avais besoin ! La qualité de ce travail n'aurait jamais été possible sans son implication. Merci infiniment ! De même, cette thèse n'aurait pas eu la même qualité sans les idées et les remarques, toujours justes et constructives, de mon directeur de thèse Lilian Bossuet et de mon co-directeur de thèse Amaury Habrard. Diriger une thèse dont 80% s'est fait à distance me semblait être un réel challenge, et pourtant, ils ont su se rendre disponibles à toute heure malgré leurs emplois du temps extrêmement chargés. Leur passion pour l'enseignement, la pédagogie et la recherche est communicative et les innombrables conseils qu'ils ont pu me prodiguer me suivront à vie. La confiance et la liberté, qu'ils m'ont accordé dans les sujets que je souhaitais traiter, a été essentiel pour m'exprimer et pour mon épanouissement. Ça a été un immense plaisir de partager ces 3 années à leurs côtés et je me sens extrêmement chanceux de les avoir eus comme directeur et co-directeur de thèse. Merci pour tout ! Je voudrais également remercier Monsieur Emmanuel Prouff et Monsieur François-Xavier Standaert pour m'avoir fait l'honneur de rapporter mon travail. C'est pour moi un réel privilège d'avoir des références incontestables du domaine pour juger mes travaux de thèse. Merci pour le temps consacré à la relecture minutieuse de mon mémoire et pour l'ensemble des améliorations qu'ils y ont apporté. Je leur en suis d'autant plus reconnaissant que je sais leurs emplois du temps chargés. Je souhaite également remercier Monsieur Thierry Artières, Madame Sonia Belaïd, Monsieur Benoît Gérard et Monsieur Marc Joye pour avoir accepté de faire partie de mon jury. Vos travaux et la façon dont vous menez vos carrières scientifiques respectives sont une grande source d'inspiration et j'espère que je saurai me montrer digne de votre confiance.

iii En parallèle, je souhaite présenter mes sincères remerciements à Monsieur Hervé Debar, Monsieur David Naccache et Monsieur Mathieu Ciet, dont les précieux conseils, qu'ils m'ont prodigués avant de débuter cette thèse, m'ont énormément apporté durant cette aventure. Je les garderai en moi tout au long de ma carrière scientifique. Merci également à Monsieur Matthieu Rivain et à CryptoExpert de m'avoir donné l'opportunité d'exploiter leurs travaux qui m'ont grandement servi tout au long de ce périple.

Outre mes trois encadrants, deux personnes ont officieusement grandement contribués aux résultats de cette thèse. Dans un premier temps, je souhaite exprimer ma profonde gratitude auprès de François Dassance (le chevalier d'argent), mon compatriote de l'ESA (un jour peut-être), qui a passé d'innombrables heures à écouter mes théories les plus étranges les unes que les autres. Merci pour tout ce qu'il a pu m'apporter, pour les discussions passionnantes autour de la physique avec pour paroxysme une expérimentation INCROYABLE visant à démontrer les effets du centre de gravité, pour m'avoir fait prendre conscience qu'une génie de 5 ans avait probablement plus de réflexion logique que moi, pour son esprit critique sur mes travaux (et nos nombreux désaccords souvent dû à ma mauvaise foi), pour tous ses conseils et pour son infinie gentillesse: 1000 mercis ! Milesker Anitz ! Merci également à Mathieu Carbone avec qui je partage l'amour de la nourriture un peu trop grasse, des restaurants un peu trop chers et des histoires un peu trop bien racontées de Christophe Hondelatte. Ces années de collaboration ont considérablement enrichi cette thèse. Son optimisme pour la recherche et le développement de nouvelles idées est une motivation constante et une source d'échange et de débats sans fin. Son parcours et ses envies professionnels m'ont fait prendre conscience qu'on ne devait pas rester cantonner dans une case, et que notre plus grande richesse est la pluridisciplinarité. Merci pour sa patience, ses remarques toujours justes et constructives, son honnêteté, ses boulettes (le Shaman, on s'en souviendra), son écoute et son partage d'expérience et de connaissances. Je m'estime extrêmement chanceux d'avoir pu partager cette aventure avec lui.

Cette thèse a eu la particularité de se dérouler au sein de deux équipes. J'ai notamment eu la chance de passer une grande partie de mon temps au sein du CESTI de Thales où j'ai pu faire la rencontre de personnes extraordinaires. En 1er lieu me vient ma "Dream Team du SCA", dont le noyau dur est composé d'Alexandre, François, Guillaume Dufresne (dit Caramel, ou le Minot), Benjamin Gamblin (dit le Castrais) et Luc Ye (dit le Blagueur du vendredi midi). Les soirées jeux de société, les chorbas entre kouf', les anecdotes démentielles de GDU ("Vous saviez que je m'étais fait livrer un colis qui est parti d'Angleterre et qui [. . .]", je ne finirais pas cette histoire car elle fera l'objet d'un livre bibliographique. Restez connecter !), les heures de jeux sur Starcraft II (je suis très mauvais, mais je reste sur 2 victoires d'affilée, mes 2 seules d'ailleurs. . .), les challenges, les restos, les "Welcome back !" de notre sensai Andrew et j'en passe, tant de bons moments qui resteront parmi les meilleurs de ces 3 dernières années. Ils ont été un soutien sans doute plus important qu'ils ne l'imaginent. En particulier, merci à Guillaume pour tous ses enseignements (sauf la fois où [. . .], ça, c'est notre petit secret) et pour tout le temps qu'il m'a accordé alors qu'il en manquait déjà. Merci à Benji pour sa gentillesse, sa bienveillance, son altruisme et sa bonne humeur quotidienne même s'il faut sans cesse lui rappeler qu'on ne met pas de "g" à "pain". Merci à Luc pour avoir été le 1er à m'accueillir et à m'intégrer au CESTI. Si j'ai pu m'épanouir aussi rapidement, c'est en grande partie grâce à lui ! Dans le même esprit, j'aimerai adresser de chaleureux remerciement à mon voisin de bureau, Julien Badoules, qui me supporte depuis plus de 2 ans. Merci pour son soutien quotidien, pour ses nombreux conseils lorsque je devais faire un choix pour mon futur et pour son amitié. Merci également à la légende du CESTI, Franck Salvador, pour l'ensemble de ses enseignements sur des sujets que je maîtrise peu. Son humilité et son exigence pour le travail bien fait sont de réelles sources d'inspiration. Merci à l'influenceur phare du CESTI, Grégoire Lewis, qui a toujours su rester le même, malgré ses millions de followers. Clémentine peut être fière de lui. Je souhaite également remercier Jérémie Delpech pour son soutien inconditionnel, pour ses vidéos hilarantes sorties des profondeurs d'internet, et pour ses lectures régulières des faits divers pittoresques dans la région de Toulouse. Je remercie aussi l'ensemble des responsables du CESTI : Joan Mazenc pour la confiance qu'il m'accorde depuis 4 ans, Suzel Lavagne, Emmanuel Doche et Rodolophe Favrel pour votre accueil au laboratoire. Et évidemment (les meilleurs pour la fin), je souhaite remercier l'ensemble de mes collègues présents et passés sans qui, cette aventure n'aurait pas été aussi épanouissante: les khouyas Riyad Amrani et Philippe Roussel, mon acolyte de la première heure Léo Larsson, Maryline Olle pour ses innombrables services, Laurent Castelnovi pour nos nombreux échanges même après son départ, l'homme à tout faire Ludovic Tyack, Réda Lounis pour sa joie de vivre communicante, Philippe Rose (promis, tu n'es pas obligé de m'appeler docteur tout le temps), François Linant dont la date d'anniversaire m'a porté chance durant ma soutenance, Oriane Agostini, Anne-Sophie Rivemale, Carine Therond, Pierre Bappel, Thierno Barry, Thomas Ben, Romain Bergé, Théo Cusnir, Cyril Mansour, Georges-Bastien Michel, Erwan Pillet, Cyril Proch, Samuel Ricou, José Soler, Romain Veriato et Martin Verdier (dit l'intouchable). Ça a été un réel plaisir de me lever tous les matins pour venir travailler à leurs côtés.

Bien qu'il fasse bon vivre dans le sud-ouest de la France, mon passage à Saint-Étienne fût d'une grande richesse. En particulier, je souhaite remercier Damien Robissout qui m'a accompagné pendant 3 ans. Partager le même sujet de thèse avec un autre doctorant est assez rare pour le souligner. Nos échanges par mail, nos heures passées au téléphone pour partager nos idées, nos aventures à Wrac'h ou à Varsovie (lorsqu'on n'avait pas encore fait la connaissance de la Covid) et les nombreux évènements, qu'il a organisés (ski à Chalmazel, bowling, escape game, raclette, . . .), resteront sans aucun doute comme les meilleurs de cette thèse. Ce fut un réel plaisir de partager autant de bons moments avec lui et je lui souhaite tout le meilleur du monde pour la suite. Cette thèse aurait sans nul doute été moins qualitative, et moins passionnante, sans la présence de Vincent Grosso. Son exigence scientifique, ses connaissances vertigineuses, son esprit critique et son humilité inégalée en font, sans aucun doute, un exemple à suivre (sauf en ce qui concerne le foot, mais je ne suis pas sûr d'être le mieux placé pour en parler). Je tiens à le remercier pour ces merveilleux moments passés en sa compagnie (sauf pour la fois où il m'a emmené à la piscine). Je remercie les anciens doctorants et postdoc passés durant mon séjour, et qui, par leurs innombrables conseils, m'ont permis de démarrer cette thèse dans les meilleures dispositions. Merci à Brice Colombier qui nous a pris sous son aile avec Damien afin de nous enseigner toutes les erreurs à ne pas commettre durant une thèse. Merci également au coureur de l'extrême, Ugo Mureddu, pour ses encouragements, dont j'avais bien besoin, avant ma 1ère présentation officielle à Phisic. Merci au prince du Maroc El Mehdi Benhani pour nos aprèsmidi de discussion autour du monde de la recherche. Merci infiniment d'avoir fait le déplacement pour venir assister à ma soutenance de thèse. Merci à ma star Elie Noumon Allini, pour ses enseignements sur le bruit blanc, la variance d'Allan et les PLLs. Son sourire radieux et son rire communicatif ont été de grands manques à mon départ de Saint-Étienne. Enfin, je souhaite remercier chaleureusement Pierre-Antoine Tissot sans qui les figures 3.3 et 3.4 de ce manuscrit n'auraient jamais vu le jour. Je remercie également l'ensemble des permanents et chercheurs associés du laboratoire Alain Aubert, Florent Bernard, Nathalie Bochard, Pierre-Louis Cayrel et Viktor Fischer pour leurs disponibilités, leur gentillesse et leurs simplicités.

Résumé

À l'heure où l'information prend de plus en plus d'ampleur dans le monde qui nous entoure, la nécessité de sécuriser nos données croît. Par conséquent, l'utilisation des algorithmes cryptographique est essentielle. Prouvés comme mathématiquement sûrs contre des attaquants en "boite noire", ces algorithmes peuvent faire l'objet d'attaques physiques lorsque ces derniers sont implémentés au sein de systèmes embarqués. En ce sens, les attaques par canaux auxiliaires peuvent être appliquées afin d'exploiter les fuites physiques (e.g. la consommation électrique) relatives aux calculs d'une implémentation cryptographique. Afin de limiter le périmètre de l'attaquant, de nombreuses contre-mesures ont été proposées (e.g. désynchronisation, schéma de masquage) afin de complexifier la mise en place de telles attaques. Cependant, les récents progrès en apprentissage profond remettent en cause ces contre-mesures et permettent d'extraire, de manière automatique, l'information sensible inclue dans les fuites physiques. Difficiles à configurer et à optimiser, les techniques d'apprentissage profond, très exploratoires, sont considérées comme des "boites noires". En particulier, aucun résultat théorique n'a permis d'établir de liens concrets entre les attaques par canaux auxiliaires, connues pour leur efficacité, et l'apprentissage profond. Par conséquent, cette nouvelle application peut être remise en cause, car la question de l'optimalité des attaques reste en suspens. L'objectif cette thèse CIFRE, menée au sein du laboratoire Hubert Curien et du centre d'évaluation de Thales (CESTI), est de réduire ces limitations dans un contexte d'évaluation sécuritaire visant à assurer la robustesse d'un système embarqué.

Introduction

This thesis is positioned at the cutting edge of Cryptography and Machine Learning with a particular focus on the application of Deep Learning techniques to enhance the performance of Side-Channel Attacks. In this chapter, we give an overview of the thesis' problematic and the contributions we have made. After providing a general introduction of Cryptography and its application in real life, we highlight the need of certification which ensures the robustness of cryptographic implementations against some attacks we present. Finally, we motivate this thesis by describing the benefits of using deep leaning to perform side-channel attacks.

The Art of the Secret

A secret is a piece of information that is only known by one person or a few people and should not be told to others. The field studying the science of the secret is called Cryptology and comes from the Greek kryptós (hidden, secret) and logia (study). More precisely, it refers to the protection of communications from an unexpected evil party called attacker or adversary. This field can be decomposed into two closely and complementary subfields: Cryptography (kryptós and graphein (to write)) and Cryptanalysis (kryptós and analýein (to analyze)).

Cryptography is the study of mathematical techniques tackling the problem of protecting some secret information through four fundamental mainstays, namely integrity, authentication, confidentiality and non-repudiation. The confidentiality is a property ensuring to keep the content of information from all but those authorized to have it. To guarantee this property some cryptographic algorithms are constructed. From a message, known as a plaintext, and a secret, referred as a secret key, a cryptographic algorithm returns an unintelligible message, namely a ciphertext, for any person that does not know the secret. A cryptographic process taking a pair (plaintext, secret) as input and returning a ciphertext is called an encryption. The inverse process generating a plaintext from a pair (ciphertext, secret) is the decryption. In this setting, the secret key is mandatory to perform the encryption and/or the decryption. Depending on how does the secret key is manipulated, the cryptographic algorithms can be categorized into two classes: symmetric and asymmetric algorithms. The cryptographic algorithms are designed to resist against adversaries. Following the Kerckhoffs' Principles [START_REF] Kerckhoffs | La cryptographie militaire[END_REF], we generally assumed that the adversary has a perfect knowledge of these algorithms. Hence, they should be secure based on their mathematical foundations only. A classical way to introduce cryptographic algorithms is to consider a communication between two parties known as Alice (sender) and Bob (receiver).

Symmetric Cryptography. Symmetric cryptography is a general term referring to the protection of a communication between a sender and a receiver who share the same secret key. An algorithm that derives from symmetric cryptography is called a symmetric algorithm. Typically, a symmetric algorithm can be useful to ensure confidentiality through encryption mechanisms and to guarantee the data integrity as well as its authenticity with the application of message authentication code (MAC). Formally, a symmetric algorithm can be expressed as follows. Assuming two characters Alice and Bob such that Alice wants to send a message to Bob through a communication channel. To ensure the confidentiality of the message, both protagonists have to share a common secret key k * . Then, before sending its message x to Bob, Alice has to encrypt it using the secret key k * and an encryption function denoted enc k * (x). The result of this encryption defines the ciphertext. Once the ciphertext is constructed, Alice sends it to Bob through a communication channel. Once Bob receives the ciphertext ciph, he uses the secret key k * and a decryption function denoted as dec k * (ciph) in order to retrieve the readable message that Alice sent. This communication process is described in Figure 1.1.

To Bob

Figure 1.1: Secure communication using a symmetric algorithm.

To convert a message to a ciphertext, an encryption function can be viewed as a stream cipher or a block cipher combined with modes of operation most of the time. Firstly, a stream cipher decomposes a message (resp. ciphertext) into single bits, which then are individually converted in order to construct a binary representation of the related ciphertext (resp. message) knowing k * . On the other hand, a block cipher combined with modes of operation decomposes a message (resp. ciphertext) into several blocks of identical size (e.g. 64 bits, 128 bits, 256 bits) and performs an encryption (resp. decryption) one block at a time. To determine a block cipher as secure, it has to ensure that two encryptions of the same block of plaintext return two different blocks of ciphertext. Thus, it prevents the risk of extracting information on the global message. More formally, a block cipher has to respect two properties [START_REF] Elwood | Communication theory of secrecy systems[END_REF]: the confusion and the diffusion.

The confusion property hides the dependency between the plaintext and the ciphertext while the diffusion ensures the dependence between one bit of the ciphertext and many bits of the plaintext and the secret key. One commonly used block cipher algorithm is called the Advanced Encryption Standard (AES) [START_REF] Daemen | The Design of Rijndael: AES -The Advanced Encryption Standard[END_REF], also known as Rijndael, designed by Joan Daemen and Vincent Rijmen. Standardized by the National Institute of Standard and Technology (NIST) in 2000, the AES algorithm operates on blocks of 128 bits. As illustrated in Figure 1.2, a round of AES is configured by multiple cryptographic primitives, namely SubBytes, ShiftRows, MixColumns and AddRoundKey. The confusion property is ensured by the substitution functions (i.e. SubBytes and AddRoundKey) while the diffusion property is ensured by the ShiftRows and the MixColumns. Deeper details on the AddRoundKey and SubBytes functions will be provided in Chapter 2. Depending on the considering key size, the number of rounds N r varies such that 10 (resp. 12/14) rounds are performed when the key size equals 128 (resp. 192/256). Other symmetric algorithms (e.g. Data Encryption Standard (DES) [START_REF] Des | Data encryption standard[END_REF]) are deprecated, because too weak security-wise, and hence are out of the scope of this thesis. Asymmetric Cryptography. In 1976, Diffie and Hellmann propose a new approach to securely communicate between multiple parties [START_REF] Diffie | New directions in cryptography[END_REF]. Indeed, asymmetric cryptography considers multiple keys (each dedicated to a party) in order to ensure confidentiality and authentication. While the confidentiality is provided by the encryption function, the authentication is guaranteed by the electronic signature which provides the same benefits as handwritten signature. This manuscript only considers the latter one. If two parties are considered, a pair of keys has to be generated for each protagonist. The first key, called private key, is only known by its owner and it is used to sign a message. On the other hand, the second key, called public key, is known by everyone and can be used by any party who wants to verify the signature provided by its owner.

The main difference between symmetric cryptography and asymmetric cryptography holds in the number of keys that are needed to perform an encryption and a decryption when a couple (sender, receiver) is considered. Formally, a digital signature algorithm can be expressed as following. Let Alice be a sender and Bob be a receiver. First, Alice constructs a public key (resp. private key) denoted p k * ,A (resp. s k * ,A ). In this process, Alice wants to electronically sign a message x. Hence, she signs her message a with her private key in order to obtain the related signature (i.e. sign = enc s k * ,A (x)). Then, Alice sends the message with its signature to Bob through a communication channel. Once Bob receives the pair (x, sign), he uses Alice's public key p k * ,A to verify the signature dec p k * ,A (sign) and checks if the result corresponds to x. This process is a In practice, the signature is not perfomed on the message itself. This simplification has been made for educational reasons. Indeed, for security reason, a signature scheme often applies a hash function to the message before applying enc s k * ,A . described in Figure 1.3. The security of asymmetric cryptographic algorithms is based on hard mathematical problems which means that even a lot of computing power will not defeat such algorithm. Classically, two main mathematical problems are considered for constructing asymmetric algorithm: the difficulty to factorize the product of two large prime numbers and the discrete logarithm problem (DLP). The first problem is the foundation of the RSA system, introduced by Rivest, Shamir and Adleman [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF]. Given two large prime numbers p and q, the public key is composed by a modulus N = p × q and an integer e co-prime with (p -1)(q -1). Then, the private key, defined by an integer d, has to respect the restriction e • d mod (p -1)(q -1) = 1. To sign a message, Alice performs the following modular exponentiation sign = x d mod N before sending the signature through the communication channel. Once Bob receives the signature and the related message, he computes sign e mod N to retrieve its content and then, verifies that it corresponds to x. This algorithm is known as a hard problem because retrieving p, q and d knowing the public key p k * ,B = (N, e) is computationally expensive. An alternative to the RSA signature algorithm is Elliptic Curve Digital Signature Algorithm (ECDSA) [START_REF]Public key cryptography for the financial services industry: The elliptic curve digital signature algorithm (ecdsa)[END_REF] that is based on Elliptic Curve Cryptography [START_REF] Miller | Use of elliptic curves in cryptography[END_REF][START_REF] Koblitz | Elliptic curve cryptosystems[END_REF].

Over the years, cryptography arises as a fundamental science for ensuring secure communication over insecure channels. Thus, its application in our modern world appears as a natural consequence.

Embedded Cryptography

Physical Attacks

The proliferation of computers and communications systems in the 1960s and a growing demand from the private sector to provide security services play a major role on the cryptography's development. Hence, cryptography-based security systems may be utilized in various applications (e.g. data storage, access control, network communications). These cryptography-based security systems, known as cryptographic modules, are defined in [FIP09]: a cryptographic module "a set of hardware, software and/or firmware that implements approved or allowed security functions ( e.g. cryptographic algorithms and key establishment) and encompasses the perimeter". One common cryptographic module is the so-called microprocessor card. A microprocessor card consists in a small physical device which is composed by a microchip and has the particularity to host its own operating system. Its ability to store and modify information in its own non-volatile memory makes this card a powerful and practical tool in various applications (e.g. mobile telephony, banking, healthy cards, etc). However, the numerous constraints of size, consumption, and usability make the microprocessor card a sensitive target to the attacks described in this thesis. The security of a cryptographic algorithm is based on the secrecy of the key. Indeed, if the key is exposed then all the security features may be violated. Therefore, it is crucial to store the secret key in an unwavering environment. Typically, standardized cryptographic algorithms can be considered as secure against black-box attacks. In such configuration, the adversary only knows the algorithm structure, the plaintext and the ciphertext used during the communication process. Based on this knowledge, the adversary aims at extracting the secret key by exploiting the intrinsic properties of the targeted cryptographic algorithm. For example, the AES algorithm has been designed to be robust against classical cryptanalysis attacks, namely differential [START_REF] Biham | Differential cryptanalysis of des-like cryptosystems[END_REF] and linear [START_REF] Matsui | Linear cryptanalysis method for des cipher[END_REF] cryptanalysis. However, this scenario does not fit anymore when cryptographic module is considered. Indeed, implementing cryptographic algorithm into a physical system requires to store the secret key into the device. Hence, these embedded systems can be defeated by some known physical attacks. Much more powerful than classical cryptanalysis techniques, the physical attacks target the implementation of cryptographic algorithms. Depending on the adversary's capabilities, we can decompose these attacks into different categories [START_REF] Mangard | Power analysis attacksrevealing the secrets of smart cards[END_REF].

Active vs. Passive Attacks. The active attack refers to a perturbation that affects permanently or temporarily the device behavior. Typically, an adversary can exploit this abnormal behavior to retrieve the secret key. The most common example has been introduced by Boneh et al. [START_REF] Boneh | On the importance of checking cryptographic protocols for faults[END_REF] and is known as the fault injection (FI) attack. It induces erroneous results being exploitable to recover the targeted secret. As opposed, the passive attack does not interact with the cryptographic module. It aims at eavesdropping the leaking information of the targeted device under a normal computational behavior. By observing the physical emanations, the adversary tries to extract some sensitive information in order to retrieve the secret key. These attacks, known as side-channel attacks (SCA), were firstly proposed by Kocher in 1996 [START_REF] Kocher | Timing attacks on implementations of diffie-hellman, rsa, dss, and other systems[END_REF]. The source of information can be large: power consumption [START_REF] Kocher | Differential power analysis[END_REF], electromagnetic emanations [GMO01, QS01], computational time [START_REF] Kocher | Timing attacks on implementations of diffie-hellman, rsa, dss, and other systems[END_REF], acoustic emanations [START_REF] Tromer | Acoustic cryptanalysis : on nosy people and noisy machines[END_REF][START_REF] Daniel Genkin | Acoustic cryptanalysis[END_REF], etc.

Invasive vs. Non-Invasive Attacks. Cryptographic modules such as microprocessor cards can be physically prepared in order to enhance the resulted attack. Depending on the level of intrusion, these attacks can be categorized into invasive, semi-invasive or non-invasive attacks. Firstly, the invasive attack is the strongest attack that can be performed against a cryptographic module. Commonly, this attack requires to irremediably alter the physical device. For example, a microprocessor card can be depackaged [START_REF] Kömmerling | Design principles for tamper-resistant smartcard processors[END_REF] in order to get a physical access to the related microchip. Thus, the adversary can establish a direct contact with the cryptographic module in order to recover the secret key. Even if this configuration is beneficial for the adversary, this requires a lot of skills, expensive equipment and the security flaws' exploitation highly depends on the targeted cryptographic module (e.g. reverse engineering). In the semi-invasive attack, the adversary also removes the package of the cryptographic module (e.g. depackaging of a microchip). It can be useful to capture the electromagnetic emanations from the system [START_REF] Gandolfi | Electromagnetic analysis: Concrete results[END_REF][START_REF] Quisquater | Electromagnetic analysis (ema): Measures and counter-measures for smart cards[END_REF] or modifying its behavior by faults injection [START_REF] Skorobogatov | Optical fault induction attacks[END_REF]. This attack differs from the invasive attack as it does not require a direct contact to the targeted system for being performed. Finally, the non-invasive attack only exploits unintentional leakage information such as running time, power consumption. Hence, no tampering are processed on the cryptographic module to reveal information on the secret. For example, measuring the power consumption [START_REF] Kocher | Differential power analysis[END_REF] and injecting faults using clock glitches or temperature variations, which does not alter the cryptographic module, [BECN + 06] are non-invasive attacks.

In this manuscript, a particular focus will be made on side-channel attacks that are considered as passive and semi-invasive/non-invasive attacks. The sources of information we consider are the power consumption and the electromagnetic emanations.

A Step Towards the Certification

The emergence of side-channel attacks as credible threats against cryptographic modules forces the governments and the industries to ensure the security of the cryptographic modules by providing some rules. These rules are defined by the certification schemes which are not limited to the side-channel threats.

Scheme. The most common scheme, namely the Common Criteria for Information Technology Security Evaluation (CC) (standard ISO/IEC 15408 [ISO]), was created in 1999. It unifies three previous standards known as the Information Technology Security Evaluation Criteria (ITSEC, led by European countries), the Canadian Trusted Computer Product Evaluation Criteria (CTCPEC, led by Canada) and the Trusted Computer System Evaluation Criteria (TCSEC, led by the United States). The CC introduces the concept of Target of Evaluation (TOE) that characterizes the system under evaluation. In particular, the certification of the TOE is made following different levels of security assurance. The Evaluation Assurance Level (EAL) starts to EAL1 (lowest security grade) and goes to EAL7 (highest security grade). This level does not measure the security of the TOE itself but states that the system is evaluated under some conditions. Indeed, they determine the complexity of the tasks that has to be made to simulate the adversary's ability. Consequently, to ensure the security and the robustness of the TOE, the certification is given for a finite period of time at the end of which it has to follow a new certification process. This ensures the robustness of the TOE against new security threats. However, the CC does not provide any details on how the cryptographic implementation should be made within a TOE. Hence, national standards release some rules that have to be respected in order to certify the specifications of cryptographic modules. The Senior Officials Group Information Systems Security b (SOG-IS) agreement defines a set of requirements and evaluation procedures related to cryptographic aspects of CC security evaluations of IT products. Participants are government organizations or government agencies from countries of the European Union (i.e. Austria, Belgium, Croatia, Denmark, Estonia, Finland, France, Germany, Italy, Netherlands, Luxembourg, Norway, Poland, Slovakia, Spain, Sweden, United Kingdom). In France, these recommendations can be substitute by the Référentiel Général de Sécurité (RGS) [START_REF] Anssi | Le référentiel général de sécurité[END_REF], that is introduced by the Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI) and provides some rules and guidelines that have to be respected by the Developper. In the United States, these requirements are provided by the Federal Information Processing Standard Publication 140-2 (FIPS 140-2 [START_REF]Security requirements for cryptographic modules[END_REF]).

Actors. Depicted in Figure 1.4, the CC defines three entities that are involved in the certification process:

• Developer -This entity conceives a product destined for sale. To ensure the reliability of the product, the developer can enter into a certification process in order to reduce the security flaws. This certification can be made for different purposes such as international recognition, commercial advantages or it can be needed for selling some specific products (e.g. the credit cards have to be certified before its use by banking companies).

• Certification body -Often represented by governmental organizations like the Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI, France), the Bundesamt für Sicherheit in der Informationstechnik (BSI, Germany) or the National Institute of Standard and Technology (NIST, United States), it delivers the certificate to the Developer and ensures the suitability of the evaluation provided by the Evaluator.

• Evaluator -It acts as a third independent party. Licensed by the certification body, this laboratory, also known as an Information Technology Security Evaluation Facility (ITSEF), must be impartial and is responsible of the security assessment of the TOE. Based on this evaluation, the Certification body decides to deliver or not the certificate to the Developer.

b The interested readers may find useful information in https://www.sogis.eu/index_en.html Evaluation Process. The certification process can be decomposed into different phases. This manuscript deliberately chooses to omit some interactions between the entities in order to simplify the process and get a global overview on it. All the entities and the exchanges we considered are summarized in Figure 1.4.

• (A) -The Developer aims at certifying one of its products. Hence, he sends a request to the Certification body and the chosen Evaluator in order to start the certification process. First, the Developer has to provide the Security Target (ST) that defines the TOE and lists the features it claims as secure.

• (B) -Once the Evaluator receives the ST, he is charged to validate the claims provided by the Developer. To this end, he produces to a vulnerability assessment that depends on the desired EAL grade. This process is performed by deeply analyzing the TOE and verifying the expected functionalities. If vulnerabilities are detected, the Evaluator determines some scenarios in order to exploit it under real conditions. Indeed, to evaluate the feasibility of these attacks, the Evaluator has to estimate a metric, called the cotation, that is based on some criteria [START_REF] Tsudik | Application of attack potential to smartcards[END_REF]: elapsed time, expertise, knowledge of the TOE, access to TOE, equipment and tools. These terms reflect the difficulty of performing an attack. Based on his investigations, the Evaluator writes an Evaluation Technical Report (ETR), defines if the TOE is secure or not, and transmits the report to the Certification body.

• (C) -From the ST and the ETR, the Certification body emits a judgment on the robustness of the TOE. If the Certification body cannot make a decision from the ETR, he can ask the Evaluator to conduct additional tests in order to facilitate its decision-making. The Evaluator should go back to step (B) in order to satisfy the requirements.

• (D) -Once the ETR is confirmed by the Certification body, it can be transmitted by the Evaluator to the Developer.

• (E) -Finally, if the features claimed by the TOE are not met, the Certification body informs the Developer that some countermeasures should be provided in order to reduce the risks exploited during the evaluation. Consequently, the Developer has to consider the ETR's recommendations provided by the Evaluator at step (D). Once the modifications are considered, the certification process goes back to step (A). On the other hand, if the security claims are respected, the Certification body supplies the certificate with the related EAL grade and can then be sold as a certified product.

Based on the certification process, the following section describes the context as well as the motivations of the thesis and defines the main criterion considered in our contributions.

Motivations & Goal of the thesis

Context. The thesis originates from the collaboration between the "CNRS Laboratoire Hubert

Curien UMR 5516 F-42023 ", part of the University of Saint-Etienne (France) and University of Lyon (France), and the Thales ITSEF (Toulouse, France). The contributions presented in this thesis have been developed in the context of a CIFRE convention (Industrial Agreements for Training through Research), a type of contract launched in 1981 to increase research activities in French enterprises by promoting the interaction with public research institutions. Conducting in an ITSEF, this manuscript falls within the Evaluator point of view (see Figure 1.4). More precisely, we focus our interest on the step (B) of the evaluation process only. To efficiently evaluate the robustness of a cryptographic module, the Evaluator has to conduct the evaluation under real conditions. As previously mentioned, the time required to perform an attack, namely elapsed time, has to be considered during the certification process. The longer the attack, the highest the cotation rate. A solution to reduce the elapsed time is to enhance the side-channel attacks by modeling the optimal solution. If this threshold is reached, the Evaluator achieves the worst-case scenario from a security point of view. This optimal solution helps him to assess the security of the TOE with a high confidence. Even if the certification process is not considered in the scope of this manuscript, the elapsed time and the optimality of a side-channel attack are crucial considerations in our contributions. Typically, a side-channel attack consists in the construction of a model correlating a set of data (e.g. power consumption and/or electromagnetic emanations) with the secret key manipulated by the targeted cryptographic module. To build this model, the Evaluator uses statistical tools (e.g. correlation) but needs to preprocess the data in order to enhance the attack performance. This preprocessing phase is based on the expertise of the Evaluator and highly impacts the performance of the related attack as well as the elapsed time of an evaluation. Finding an alternative model which automatically maps a set of data with the correct unknown secret key without any preprocessing phase is crucial in order to reduce the elapsed time attribute while preserving the ability of the Evaluator to recover the unknown secret key. These models can be designed from Machine Learning approach which is an application of the Artificial Intelligence c paradigm. It provides to algorithms the ability to automatically learn how a given task should be solved from successive experiences and by the use of data This phenomenon is illustrated in Figure 1.6. This figure depicts the evolution of the number of papers dealing with DLSCA issues since 2015. The database we use lists the deep learningbased side-channel papers we observed on ePrint d and arXiv e during this period of time. From the Evaluator point of view (e.g. ITSEF), the deep learning-based side-channel analysis can be highly recommended. While a large part of an evaluation process is to define the adequate preprocessing for limiting the impact of some countermeasures, this new direction can be favorable to reduce the effort of the Evaluator for assessing the TOE's security. However, while the side-channel attacks are based on strong mathematical foundations, the deep learning models can be difficult to fully understand and are oftenly seen as black-boxes (see Figure 1.5). Thus, their interpretation and their configuration are considered as non-trivial tasks for the Evaluator.

Goal.

In this thesis, we want to tackle the problem of black-box issues as well as side-channel attack optimality in order to limit as much as possible the preprocessing phase without altering the efficiency of the models. In order to reach these objectives, we first aim at bridging the gap between deep learning and classical side-channel attacks by investigating new kinds of models based on different strategies. This direction is beneficial to reduce the black-box issues and concretely illustrate the benefits and the limitations of the deep learning techniques applied in side-channel context as well as defining some insights to construct an effective model. Furthermore, while the state-of-the-art considers classical deep learning metrics to train a model, we aim to construct new metrics that are specific to the side-channel context in order to approximate the optimal solution. In parallel, to facilitate the reproducibility of our results, we decide to follow one common approach considered by the machine learning community which deeply encourages the papers to provide the code and/or the dataset accompanying their submission. In the major conferences, reproducibility of results and easy availability of code is taken into account in the decision-making process (e.g.

Neural Information Processing Systems (NeurIPS), International Conference on Machine Learning (ICML), European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases (ECML PKDD), Conference on Computer Vision and Pattern Recognition

(CVPR), etc.). For example, to ease the code publication format, NeurIPS defines a clear policy f to follow and suggests a template g the authors can use in order to standardize the submission process. Following this approach can be beneficial when deep learning techniques are applied in side-channel context. By pursuing this ideology, we are one of the first authors in the DLSCA field (see Figure 1.6) to open our research by making publicly available the source code h [ZBHV19a, ZBD + 20a, ZBHV21a, ZBC + 21a] of our contributions we describe in the following section.

Contributions

This section summarizes the contributions we propose in this manuscript and describes the outline of the thesis.

Bridging deep learning and classical profiled side-channel attacks.

While the first papers in DLSCA were released in 2013, no particular investigations were made to connect the side-channel and deep learning's worlds. In Chapter 5, we reduce this theoretical gap by first, linked the stochastic models proposed by Schindler et al. [START_REF] Schindler | A stochastic model for differential side channel cryptanalysis[END_REF] with the generative approach commonly used by the deep learning community. This rapprochement, proposed in Chapter 5, helps us to construct the first generative model that serves to understand the benefits and the limitations of the deep learning-based side-channel attacks. While classical deep learning models are seen as black-box tools, this new network, called Conditional Variational AutoEncoder-based Stochastic Models (cVAE-ST), can be fully explained from a side-channel perspective. Presented in Chapter 5, this network is derived from the stochastic models and can easily argue the benefits of classical preprocessing techniques considered by the side-channel community (i.e. dimensionality reduction, point of interest selection, synchronization, etc). To deal with the Evaluator point of view, we focus a particular interest on the ease of network configuration in order to limit the elapsed time criterion. Hence, we define a theoretical complexity bounds of the network and suggest its minimal complexity given a set of point of interests. Then, we demonstrate the ability of the cVAE-ST to approximate a leakage trace and extended its application to a wide range of case study. Finally, we define the benefits and the limitations of this new proposition and suggest some improvements that can be provided by the discriminative approach. The solutions proposed in Chapter 5 have been presented at [ZBC + 21b]. In addition, all the experiments provided in this chapter are reproducible [ZBC + 21a].

Construction of discriminative models. While the cVAE-ST are beneficial from an evaluation perspective as it is fully interpretable, the classical DLSCA approach, namely discriminative models, are suggested as more powerful than generative models [START_REF] Ng | On discriminative vs. generative classifiers: A comparison of logistic regression and naive bayes[END_REF]. However, as the design of such neural network architecture is an arduous task, it is crucial to deeply understand how does the Evaluator have to configure them in order to exploit the security flaws of cryptographic module. Hence, in Chapter 6, we propose to decompose the most widely use network, namely a Convolutional Neural Network (CNN), into a convolutional and a classification part in order to deeply characterize the impact of some hyperparameters that compose the convolutional part. Assessing its impact to retrieve the point of interests helps us to construct a new convolutional part that drastically reduces the network complexity without altering the point of interest detection and the resulted performance. In a nutshell, we propose to reduce the desynchronization effect by focusing the network on the point of interests only and reducing the effect of the uninformative time samples. This result is in contrast to the DLSCA literature that is mostly inspired from the computer vision field. While our contribution outperforms the results obtained by the state-of-the-art, it questions the need of complex networks to perform efficient side-channel attacks. The solutions proposed in Chapter 6 have been presented at CHES and published in the journal IACR Transactions on Cryptographic Hardware and Embedded Systems (TCHES) [ZBHV19b]. In addition, all the experiments provided in this section are reproducible [ZBHV19a].

To obtain the most powerful models, the Evaluator has to optimize the discriminative approach in order to converge towards the optimal Adversary. From an evaluation perspective, converging towards the optimal Adversary is beneficial in order to fully assess the robustness of the cryptographic module against side-channel attacks. Part III is decomposed into two categories: performance/learning metrics and network combination.

Assessing the efficiency of a generative/discriminative model. To evaluate the relevance of the network, the Evaluator monitors the related performance metric for estimating its efficiency to perform a side-channel attacks. As illustrated in [CDP17a, PHJ + 18], the classical deep learning metrics do not fit with the side-channel paradigm. To mitigate this issue, we propose a new performance metric which derives from a well-known side-channel performance metric: Success Rate. This proposition indicates the number of iterations the network has to be updated in order to attain its best side-channel performance. Hence, during the training process, the Evaluator can assess the efficiency of the generated model. The solutions proposed in [RZC + 21] have been presented at International Workshop on Constructive Side-Channel Analysis and Secure Design (COSADE) and published in the proceedings of the international conference. This contribution will not be presented in this thesis as it was mainly handled by another co-author

CHAPTER 1. INTRODUCTION Damien Robissout.
Convergence towards the optimal models. Then, in Chapter 7, we extend the work provided by Masure et al. [START_REF] Masure | A comprehensive study of deep learning for side-channel analysis[END_REF] which determines how far a DLSCA model converges towards the optimal side-channel solution. Actually, the most classical loss function used for training models in DLSCA, namely the Negative Log Likelihood, is not optimal. To overcome this drawback, we propose a new loss function which derives from the Success Rate described in [START_REF] Standaert | A unified framework for the analysis of side-channel key recovery attacks[END_REF]. We demonstrate the benefits of this metric from a side-channel and a deep learning perspective in order to assess its suitability for the Evaluator. Considering our contribution maximizes the success rate of a side-channel attack by minimizing the ranking error of the secret key in comparison with all other key hypotheses. It reduces the errors provided by the cross-entropy loss function and generate a model converging towards the optimal solution. From an evaluation perspective, it is therefore possible to precisely assess the robustness of cryptographic module against sidechannel attacks. Published in the journal IACR TCHES [ZBD + 20b], this new proposition is finally experimentally compared with the most classical metric used in DLSCA context. In addition, all the experiments provided in this section are reproducible [ZBD + 20a].

Benefits of diversity to enhance side-channel attacks. While a single network can be limited to retrieve relevant information related to the secret key, the combination of multiple networks can handle this problem. Known as Ensembling approach, it consists in mixing of several discriminative models in order to reduce its overall error. For being effective, this approach has to aggregate the result of diverse models, i.e. with uncorrelated errors. In Chapter 8, we propose a new loss generating interactions between the networks in order to reduce as much as possible the correlated errors. Hence, from the Evaluator perspective, this proposition can be useful to increase the performance of the related side-channel attack. While most of the literature focuses its interest on the symmetric implementations only, the Evaluator also has to cope with asymmetric implementation. Hence, we propose to evaluate the benefits of our contribution on cryptographic modules implementing asymmetric algorithms (i.e. RSA and ECC). During an evaluation, a side-channel attack against asymmetric implementations is rarely sufficient to retrieve the entire bit of the secret key. Typically, the Evaluator has to combine side-channel and partial attacks to extract the secret key from the cryptographic module. In order to assess the suitability of the proposed loss in the evaluation process, we evaluate the impact of the performance gain on the remaining partial attack under different scenarios. The solutions proposed in Chapter 8 have been presented at CHES and published in the journal IACR TCHES [ZBHV21b]. In addition, all the experiments provided in this section are reproducible [ZBHV21a].

To introduce these contributions, Chapter 3 proposes a general introduction to Side-Channel Analysis and presents some classical models and metrics used during an evaluation. A general survey of the main attacks and countermeasures is defined. Then, Chapter 4 describes the general notion of Deep Learning as well as the statistical learning theory which defines the problem of finding a predictive function based on a set of data. These chapters are preceded by a formal description of the mathematical background we consider in this manuscript and is introduced in Chapter 2 which follows.

CHAPTER 2. MATHEMATICAL BACKGROUND

The number of elements in a field F is called the order of F. A finite field is simply a field whose underlying set has a finite number of elements. In the following, a finite field of order p is denoted F p , and, for any positive n, we denote F n 2 the vector space over F 2 of dimension n.

Definition 2.2.2 (Binary representation of an integer). Let a be an integer such that its binary representation is (a

[n -1]a[n -2] . . . a[0]) 2 with: a = n-1 i=0 2 i • a i ,
with a i ∈ {0, 1}. We define a[0] as the least significant bit (or LSB) value while a[n -1] denotes the most significant bit (or MSB) value.

The exclusive or (XOR) operator is denoted ⊕ and is defined for every (a, b) ∈ {0, 1} as follows:

a ⊕ b = 1 if a = b, 0 if a = b.
The AND operator, denoted ∧, is defined for every (a, b) ∈ {0, 1} as follows:

a ∧ b = 1 if a = b = 1, 0 otherwise. For every a = (a[n -1]a[n -2] . . . a[0]) 2 ∈ F n 2 and b = (b[n -1]b[n -2] . . . b[0]) 2 ∈ F n 2
, the vectorial XOR (resp. AND), often called bitwise addition (resp. bitwise multiplication), can be expressed as:

a b = (a[n -1] b[n -1] . . . a[0] b[0]) 2 ,
with denoting ⊕ or ∧.

Basics on Linear Algebra & Vector Analysis

As the linear algebra is essential for understanding and working with many machine learning algorithms, this section introduces the notions used throughout this manuscript.

Definition 2.3.1 (Matrix).

A matrix A is a 2D-array defined in rows and columns such that M n,m (R) denotes the matrix space of n rows and m columns so that each coefficient (a ij ) 0≤i<n,0≤j<m is in R.

One specific operation on matrices is the transpose. It characterizes the mirror image of a matrix across its main diagonal axis. The transpose operation of a matrix

A ∈ M n,m (R) is denoted A T ∈ M m,n (R)
such that each of its coefficient at the i th row and the j th column is defined as

a T ij = a ji . A matrix A is known as symmetric if A T = A.
In other words, A is symmetric if the mirror elements with respect to the main diagonal axis are equal (i.e. a ij = a ji ).

One special case matrix is the square diagonal matrix, which is defined to have all of its elements equal to zero except those on the main diagonal. Thus, a square diagonal matrix A ∈ M n,n (R) can be written as follows:

A =        a 00 0 0 • • • 0 0 a 11 0 • • • 0 0 0 a 22 • • • 0 . . . . . . . . . . . . . . . 0 0 0 • • • a n-1 n-1        n columns            n rows
The trace of a square diagonal matrix A is an operator that gives the sum of all the diagonal entries of A such that:

tr(A) = n-1 i=0 a ii .
A particular square diagonal matrix is the square identity matrix I, which is defined to have all of its coefficients (a ii ) 0≤i<n equal to 1 (i.e. tr(A) = n). In the rest of this manuscript, I n denotes a square identity matrix in M n,n (R).

While elementary matrix addition and matrix multiplication are defined, the matrix division does not hold. However, for a square matrix, multiplication by its inverse may be thought as an analogous operation. Let A be a square matrix in M n,n (R), we denote A -1 its inverse if the following relationship hold:

A -1 A = AA -1 = I n .
The readers should notice that the matrix multiplication is not commutative, i.e. the condition AB = BA, such that A ∈ M m,n (R) and B ∈ M n,p (R), is not always true. The importance of the inverse matrix can be seen from the solution of a set of algebraic linear equations such as:

Ax = b,
If the inverse A -1 exists, then the previous equation can be rewritten as follows:

A -1 Ax = A -1 b, Ix = A -1 b, x = A -1 b.
The inverse of a matrix does not always exist. If a matrix A ∈ M n,n (R) is invertible, it is defined to be non-singular. If A -1 does not exist, the matrix is singular.

One common solution to verify if A is a singular matrix consists in computing its determinant, denoted |A|. If |A| = 0, then space is completely reduced along at least one dimension and thus, induces a singular matrix.

Norm. Sometimes we will need to measure the distance of a vector x ∈ R n , from the origin, through the computation of the L p -norm. The related distances are also called Minkowski distances.

Definition 2.3.2 (L p -norm). Given a vector x ∈ R n , the L p -norm is defined as follows:

||x|| p = n-1 i=0 |x[i]| p 1 p , for p ∈ R + .
Different norms on a vector space can give rise to different geometrical and analytical structures. In Figure 2.1, we can see the shape of the L p -norm for various values of p such that ||x|| p = 1. In particular, the following three specific norms are frequently used:

• L 1 -norm -||x|| 1 = n-1 i=0 |x[i]|. • Euclidean Norm -||x|| 2 = n-1 i=0 |x[i]| 2 . • L ∞ -norm -||x|| ∞ = lim p→∞ n-1 i=0 |x[i]| p 1 p .
While the Euclidean norm is classically used in Machine Learning, it can be undesirable because it increases very slowly near the origin. While it is important to discriminate the very small values from those that exactly equal zero, the application of the L 1 -norm can be beneficial. Thus depending on the scenario, the p value should differ. Gradient and Jacobian matrix. Given a function f : R n → R, ∂f (x)

∂x [i] defines the partial derivative of f with respect to the i th entry of a random vector x ∈ R n . This partial derivative measures how the function f is affected as only the element x[i] varies from x. The gradient, denoted ∇ x f (x), generalizes this notion to a vector x such that:

∇ x f (x) = ∂f (x) ∂x[0] , ∂f (x) ∂x[1] , . . . , ∂f (x) ∂x[n -1] . (2.1)
When we move to derivatives of a function f : R n → R m , then, the matrix containing all the partial derivatives is known as the Jacobian matrix and it is denoted J f ∈ M m,n (R) such that:

J f (x) = [∇ x f (x)[0], ∇ x f (x)[1], . . . , ∇ x f (x)[m -1]] T . (2.2)
The Gradient and the Jacobian matrix are essentially used to solve optimization problems in Section 4.3.

Basics on probability theory

In this section, we introduce all the needed notations related to the probability theory.

Recall on probability.

The probability of observing an event X is denoted by Pr[X] such that a conditional probability of observing an event X knowing an event Y is denoted Pr[X|Y ].

Besides, the indicator function, denoted by 1 X , equals 1 if the event X is realized and 0 otherwise.

In probability theory and statistics, a probability distribution is a statistical function that describes all the possible values and likelihoods that a random variable X can take within a given range. If X denotes a continuous random variable, the related probability distribution is computed from a Probability Density Function (PDF), denoted by f X , and that satisfies, for every a ∈ X and b ∈ X :

Pr [a ≤ X ≤ b] = [a,b] f X (x)dx,
and such that X f X (x)dx = 1 and for every x ∈ X , f X ≥ 0. Otherwise, every discrete random variable X is associated with a Probability Mass Function

(PMF) f X : x → Pr[X = x].
In the rest of the manuscript, the set of every PMF is denoted by P(X ). The notation x → Pr[x] for a continuous random variable X may be further used without ambiguity to denote the PDF of X.

Sometimes, it can be useful to compute the joint probability distribution of two, or more, events such that it characterizes the probability distribution of the intersection of those events. Typically, given two discrete random variables X and Y , the related joint probability mass function can be expressed as:

Pr [X = x, Y = y] = Pr [Y = y|X = x] • Pr [X = x] = Pr [X = x|Y = y] • Pr [Y = y] ,
for every x ∈ X , y ∈ Y and such that Pr [Y = y|X = x] (resp. Pr [X = x|Y = y]) denotes the conditional probability of observing the event Y (resp. X) knowing the random variable X (resp. Y ). In particular, Pr

[X = x, Y = y] = Pr[X = x] • Pr[Y = y]
if and only if X and Y are independent and the joint probability is then the product of the two marginal probabilities. If both random variables are conditionally independent given a random variable Z, then,

Pr[X = x, Y = y|Z = z] = Pr[X = x|Z = z] • Pr[Y = y|Z = z].
Given the joint probability distribution of two discrete random variables X and Y , it is possible to compute the conditional probability Pr[X = x|Y = y] following Bayes' Theorem:

Pr [X = x|Y = y] = Pr [Y = y|X = x] Pr [X = x] Pr [Y = y] .
In many occasions, we may know the joint probability distribution of two (continuous or discrete) random variables X et Y and we want to characterize the probability distribution of each random variable independently (e.g. Pr[X = x] for every x ∈ X ). This probability distribution is known as the marginal probability distribution and can be computed for every x ∈ X as follows:

Pr [X = x] = y∈Y Pr [X = x, Y = y] .
Moments. The moments of a random variable X are quantities providing information about the shape and location of its PMF (discrete case) or its PDF (continuous case). E[X] is used to denote the expected value of a random variable X such that, if X is a discrete random variable, then:

E[X] = x∈X x • Pr [X = x] ,
while for continuous random variables, it is computed as follows:

E[X] = X x • Pr [x] dx.
The expected value is notably used to measure the location or the central tendency of X . E X∼P defines under which probability distribution it is computed. In addition, the second central moment, also known as the variance, of a random variable X is defined as:

V[X] = E (X -E [X]) 2 = E X 2 -E [X] 2 . The symbol V X [f (X)] (resp. E X [f (X)]
) denotes the variance (resp. expected value) of a function f of the random variable X, over the distribution of X.

The standard deviation of a random variable X, denoted σ X , is defined as the square root of its variance:

σ X = V [X].
The covariance Cov[X, Y ] between two random variables X and Y is defined by:

Cov [X, Y ] = E [(X -E [X]) (Y -E [Y ])] = E [XY ] -E [X] E [Y ] . This equation implies Cov[X, X] = V[X]. If X denotes a D-dimensional random variable X = (X 0 , X 1 , . . . , X D-1
), its expectation is defined as the vector composed of its coordinate expectations. The related covariance matrix Σ X of a random vector X is an extension of the variance to a multivariate random variable that is defined as follows:

Σ X = (Cov [X i , X j ]) 0≤i<D,0≤j<D .
Probability distributions. Through this thesis two probability distributions are essentially used:

• Discrete Uniform Distribution -A random variable X follows a discrete uniform distribution over X , if, each element x of the finite set X has an equal probability Pr

[X = x] = 1 |X | .
• Gaussian Distribution -Also known as the normal distribution, we use the symbol X ∼ N D (µ, σ 2 ) to denote a random variable X that follows an univariate Gaussian distribution of parameters µ ∈ R and σ ∈ R + such that the corresponding PDF is defined by:

f X (x) = 1 √ 2π • σ 2 exp - 1 2 x -µ σ 2 .
The multivariate Gaussian distribution of dimension D with expectation vector µ ∈ R D and the covariance matrix Σ ∈ M D,D (R) is denoted N D (µ, Σ) such that the related PDF f X can be defined as follows:

f X (x) = 1 (2π) D • |Σ| exp - 1 2 (x -µ) T Σ -1 (x -µ) . (2.3)
We define X ∼ N D (µ, Σ) to denote a random variable X that follows a multivariate Gaussian distribution of parameters µ ∈ R D and Σ ∈ M D,D (R).

Information theory

In this section, we define the information theory quantities needed in the rest of this thesis.

In information theory, the Shannon entropy of a discrete random variable X measures the amount of information contained by a realization of X.

Definition 2.5.1 (Entropy). Given a discrete random variable X, the entropy of X, denoted H(X), can be computed as follows:

H(X) = - x∈X Pr [X = x] • log 2 (Pr [X = x]) .
From this notation, we can extend the Shannon entropy to the conditional entropy of a random variable X knowing Y is defined by:

H(X|Y ) = y∈Y Pr [Y = y] • H (X|Y = y) = - y∈Y Pr [Y = y] • x∈X Pr [X = x|Y = y] • log 2 (Pr [X = x|Y = y]) .
To quantify how much information can be extracted about X by observing a second random variable Y , the notion of Mutual Information can be used.

Definition 2.5.2 (Mutual Information). Let (X, Y ) be two discrete random variables with values over the space X ×Y. The mutual information, denoted by M I (X; Y ), between those two random variables can be expressed as follows:

M I (X; Y ) = H (Y ) -H (Y |X) = H (Y ) + y∈Y Pr [Y = y] • x∈X Pr [X = x|Y = y] • log 2 (Pr [Y = y|X = x]) = D KL (Pr[X, Y ]||Pr[X]Pr[Y ]),
where the D KL function is known as the Kullback-Leibler (KL-) divergence [START_REF] Kullback | On information and sufficiency[END_REF]. The KLdivergence is always non-negative and equals zero if and only if

Pr[X, Y ] = Pr[X]Pr[Y ].
From this result, we can introduce the conditional mutual information that quantifies the amount of information Y reveals on X given a random variable Z as follows:

M I(X; Y |Z) = H(Y |Z) -H(Y |X, Z) = z∈Z Pr[Z = z] (x,y)∈X ×Y Pr[X = x, Y = y|Z = z] log Pr[X = x, Y = y|Z = z] Pr[X = x|Z = z]Pr[Y = y|Z = z] .
Introduced by McGill [START_REF] Mcgill | Multivariate information transmission[END_REF], interaction information is a multivariate generalization of mutual information for measuring dependence among multiple random variables. The interaction information M I({X

0 , X 1 , • • • , X n }) between n + 1 random variables {X 0 , X 1 , • • • , X n }, denoted
as {X 0:n } in the following sections, and the conditional interaction information M I({X 0:n }|Y ) are respectively defined as:

M I({X 0:n }) = M I(X 0 ; X 1 ) if n = 1, M I({X 0:n-1 }|X n ) -M I({X 0:n-1 }) for n ≥ 2. M I({X 0:n }|Y ) = E Y [M I({X 0:n })|Y ] .
Those notions of information theory are essentially used in Chapter 7 and Chapter 8.

In the next chapter, we continue to introduce the notions required for this thesis by focusing on the Side-Channel Analysis field.

Chapter 3

Side-Channel Analysis

In this chapter, we describe the link between physical leakage and data dependence. Then, we present the entire process the Evaluator conducts during the security evaluation. This includes a description of the measurement setup as well as statistical tools allowing the detection of time samples where the targeted data leak. This chapter continues with an introduction of the optimal side-channel attack and describes the classical approaches considered to retrieve a secret information. Finally, classical countermeasures, which make the cryptographic module more robust against side-channel attacks, are presented. This chapter is an overview of the side-channel literature, hence, readers who are already familiar with this field can skip it, although the material may be useful to get familiar with the notations and terminologies used in this manuscript.

CHAPTER 3. SIDE-CHANNEL ANALYSIS

Power Consumption & Data Dependency

CMOS Circuit

To extract the information from a cryptographic module, the Evaluator exploits the security flaws induced by the physical component. Most of the chips are implemented using the Complementary Metal Oxide Semiconductor (CMOS) technology to perform logical operation. One of the simplest examples of the CMOS is the inverter with lumped-C (see Figure 3.1). Composed by two transistors, namely a P-channel Metal Oxide Semiconductor (PMOS) and a N-channel Metal Oxide Semiconductor (NMOS), the power consumption of the CMOS inverter depends on a static and a dynamic power consumption, respectively denoted as P stat and P dyn . P dyn is characterized by the switching of logic cells while P stat denotes the circuit consumption when no process of switching occurs. For a given moment of time, four input transitions can be observed (i.e. 0 → 0, 0 → 1, 1 → 0, 1 → 1). In two cases (i.e. 0 → 0, 1 → 1), the input of the CMOS circuit stays constant and its consumption only depends on P stat , while in the other two cases (i.e. 0 → 1, 1 → 0), the combination of P stat and P dyn is consumed. Hence, the consumption of the CMOS circuit depends on the transition it performed. If an input transition 1 → 0 is observed, PMOS (resp. NMOS) turns to ON (resp. OFF ) and charges a capacitor C L . In this setting, a direct path exists between V out and V DD , resulting in a steady-state value of 1. On the other hand, if an input transition 0 → 1 is observed, NMOS (resp. PMOS) turns to ON (resp. OFF ) and discharges C L . Thus, V out is modified to output a 0 value. This short introduction highlights the dependence between the data manipulated by the cryptographic module and its related power consumption [START_REF] Mangard | Power analysis attacksrevealing the secrets of smart cards[END_REF]. If the Evaluator captures a power consumption resulting from a cryptographic function (e.g. encryption, decryption), he can correlate it with the data processed and thus, guess the secret key. To perform this correlation, he has to model the expected behavior of the targeted cryptographic model in order to enhance its ability to extract the secret key.

V DD V out V in P MOS N MOS C L V SS Figure 3.1: Structure of a CMOS inverter.

Leakage Model

Performing a side-channel attack consists in mapping data values, which are processed by the cryptographic module, to the related power consumption. For exploiting the dynamic power consumption, the Evaluator has to consider a metric to characterize the following transitions: 0 → 1 and 1 → 0.

Definition 3.1.2.1 (Hamming Distance). Let a ∈ F n 2 and b ∈ F n 2 , the Hamming Distance between a and b is defined as follows:

HD(a, b) = n-1 i=0 1 a[i] =b[i] ,
where a[i] (resp. b[i]) denotes the i th bit of a (resp. b).

The basic idea of the Hamming Distance is to count the number of transitions that occurs when a → b. Hence, for two consecutive values, this metric correlates this number with the related power consumption. However, even if this metric is suited to describe the leakage consumption, it requires the knowledge of the preceding and the succeeding data values. Consequently, if the Evaluator does not have enough knowledge to predict the transition, he has to consider a simpler solution.

Definition 3.1.2.2 (Hamming Weight). Let a ∈ F n 2 , the Hamming Weight of a is defined as:

HW(a) = n-1 i=0 1 a[i]=1 ,
where a[i] denotes the i th bit of a.

Remark 3.1.2.1. Let a ∈ F n 2 and b ∈ F n 2 , HD(a, b) = HW(a ⊕ b).
As defined for the Hamming Distance, the Hamming Weight describes the number of transitions that occur when a → b such that a equals 0. Thus, the Evaluator assumes that the power consumption and the processed data are proportional to the number of bits set to 1. Due to the assumption on a, this metric does not entirely characterize the power consumption of the CMOS circuit because it does not describe the transitions involved. Hence, depending on its knowledge, the Evaluator has to adequately choose the best leakage model. Typically, the leakage model produced by the computation of a data in F n 2 is modelled by a D-size random vector over

R D . If D = 1, the leakage model is said univariate, otherwise if D > 1, the leakage model is said multivariate. Definition 3.1.2.3 (Leakage Model). A leakage model is a function ψ : F n 2 → R D
characterizing the dependence between the data manipulated by the cryptographic module and the related power consumption.

Even if the most classical leakage models are defined by the Hamming Distance and the Hamming Weight, a plethora of solutions exists:

• Mono-bit leakage model -instead of considering the entire data, the Evaluator can describe the activity induced by a single bit of the processed data.

• Linear leakage model -in [START_REF] Schindler | A stochastic model for differential side channel cryptanalysis[END_REF], Schindler et al. propose a custom leakage model that is a linear combination of bits. The particularity of this solution is to capture the bits' interaction of the processed data in order to find a leakage model with a lowest granularity level. Notably, the Hamming Weight can be seen as a solution of the linear leakage model.

All these propositions will be considered in this manuscript. However, how does the Evaluator capture the power consumption from a chip implemented with the CMOS technology? How can he exploit the security flaws we revealed based on a leakage model ψ? The following section tries to answer these questions. decryption) and obtains the related output (e.g. ciphertext, signature). During the processed of the cryptographic function, the oscilloscope captures the corresponding signal with the help of a probe. If the Evaluator wants to capture the power consumption of the cryptographic module, a solution consists in the insertion of a small resistor in series with the power supply or the ground. Connected to the oscilloscope, the current probe measures the voltage difference across the resistor. This channel captures the entire power consumption of the device under test. The resulted signal is not only dependent on the targeted cryptographic function but also on the other operations performed simultaneously. This noise, namely switching noise, refers to the variations induced by cells that do not depend on the targeted cryptographic function. Depending on its prominence, the quality of the signal can be highly impacted. A solution to reduce this risk is to precisely locate the cryptographic function's activity. To this end, the Evaluator can use a probe that captures the electromagnetic fields of the cryptographic module in order to reveal more information about the targeted cryptographic function. To measure an isolated signal emitted by the device under test (e.g. encryption, decryption), the Evaluator has to position its probe near to the cryptographic core. However, as the signal highly varies with the position of the probe, an incorrect probe's location can significantly decrease the effectiveness of a side-channel attack. While the performance of a side-channel attack highly depends on the noise induced in the exploited signal, it is essential to adequately select the channel.

Side-Channel Evaluation

Measurements

To validate the probe position, the Evaluator can visualize the related signal and assess its suitability regarding the targeted cryptographic function. In Figure 3.3, the Evaluator captures the signal corresponding to an AES-128 encryption. As illustrated, the 10 rounds of the cryptographic algorithm can be clearly observed as well as the cryptographic primitive, namely AddRoundKey, SubBytes and MixColumns. Since ShiftRows do not handle arithmetic operations, it cannot be visualized on the power consumption. With the help of the signal, the Evaluator reveals the different operations occurring during the encryption of a message. Based on this representation, he extracts some information that depends on the secret key manipulated by the cryptographic module. This extraction procedure will be defined in Section 3.3. In the following, no particular distinction will be made between electromagnetic emanations and power consumption. satisfying the Gaussian Indepedent Noise Assumption a :

T = ψ(Y ) + Z, (3.1)
where ψ(.) denotes the leakage model, Y depends on the targeted secret and we assume that the noise Z follows a multivariate Gaussian distribution N D (µ, Σ) with unknown parameters (µ, Σ). Thus, T can be decomposed into a deterministic (i.e. ψ(Y )) and a random (i.e. Z) part such that the deterministic part is non-negligible if the secret key is manipulated. During the evaluation process, the Evaluator aims at extracting the deterministic part from the leakage trace in order to retrieve the secret used by the cryptographic function. However, how does the Evaluator retrieve the time sample which depends on the secret key? The following section presents the tools the Evaluator considers to perform this analysis.

Leakage Assessment

To assess the security of a cryptographic module, the Evaluator has to estimate its ability to extract the deterministic part defined in Equation 3.1.

Definition 3.2.2.1 (Sensitive variable). A sensitive variable, denoted Y = f (x, k * ), is an internal state of the cryptographic function which depends on a value the Evaluator targets (e.g. secret key, secret random value) and a cryptographic primitive f : X × K → Y (e.g. output of the Sbox, a XOR between a plaintext x ∈ X and a secret key k * ∈ K).

In that purpose, the Evaluator uses leakage metrics which measure the information contained in a leakage trace T regarding a processed sensitive variable Y .

Definition 3.2.2.2 (Point of interest). Given a leakage trace T, a point of interest is a time sample with a non-negligible deterministic part (i.e. ψ(Y )[i] = 0).

From the Evaluator perspective, the leakage assessment is helpful to find the points of interest (PoIs) and evaluate the security flaws induced in a cryptographic module. Furthermore, it can also be beneficial to validate the observed processing of a leakage trace and the detected point of interest. As an example, in Figure 3.3, if the Evaluator considers the output of the Sbox in the first round as his sensitive variable, he expects to obtain one or multiple PoIs between time samples 1, 000 and 1, 700. Typically, to detect these PoIs, the Evaluator can apply two types of leakage metrics: the non-specific and the specific leakage metrics.

a This means that the Gaussian noise Z is independent of the variable Y .

CHAPTER 3. SIDE-CHANNEL ANALYSIS

Non-Specific leakage metric. Given a set of leakage traces, this metric does not require any prior knowledge on the cryptographic module under test (i.e. sensitive variable) or any assumption about how it leaks (i.e. leakage model). Mostly applied under black-box restrictions, it gives a level of confidence related to the presence of leakages without specifying its dependence with the secret key. Thus, it does not provide any information about the robustness of the device against physical attacks. However, using this metric is highly beneficial from the Evaluator point of view in order to get a rapid overview of the cryptographic module's behavior (e.g. flaws in the implemented countermeasures). A common example considers the Welch's T-test [START_REF] Lewis | The generalization of 'student's' problem when several different population variances are involved[END_REF] to perform this assessment [GJJR11, BCD + 13]. Let T A and T B be two sets of leakage traces respectively associated to fixed and randomly generated sensitive variable (i.e. fixed vs. random) b . Let also

µ A [i] (resp. µ B [i]) and σ 2 A [i] (resp. σ 2 B [i]
) be the mean and the variance of the i th time sample of T A (resp. T B ). For targeted cryptographic modules, the Welch's T-test associated with the i th time sample is defined as c :

T test(T A , T B )[i] = µ A [i] -µ B [i] σ 2 A [i] N A + σ 2 B [i] N B ,
where N A (resp. N B ) denotes the number of leakage traces in T A (resp. T B ).

The result determines if the sets T A and T B are drawn from the same distribution (i.e. null hypothesis). If two sets do not have similar means and variances, the null hypothesis is rejected and the Evaluator can assess that the time samples of T A differ from T B . Following [START_REF] Schneider | Leakage assessment methodology[END_REF], this decision can be made following a threshold. Indeed, if |T test| > 4.5, the null hypothesis can be rejected without any other consideration. This threshold was questioned in [DZD + 18] such that it can lead to erroneous results for high-dimensional leakage traces. However, running independent Welch's T-test multiple times can reduce this risk by only considering the leakages that appear at the same time samples. Analyzing the evolution of T test over the time samples is highly recommended to visualize the difference induced in both sets of leakage traces. However, even if this solution is quite useful, the observed points of interest are not necessarily beneficial to perform a side-channel attack. While no correlations are made between these leakages and the targeted sensitive variable, the related exploitation can result in a poor performance. To precisely identifying some correlations between the targeted sensitive variable and the leakage traces, the Evaluator has to apply specific leakage metrics.

Specific leakage metric.

This metric aims at identifying the time samples dependent on a targeted sensitive variable. To perform this assessment a specific partition of the sensitive variable has to be made given a chosen leakage model. An example is the application of a classical signal processing metric, namely Signal-to-Noise Ratio (SNR). Given a set of leakage traces and its related sensitive variable Y , the Evaluator can compute the signal-to-noise ratio such that the i th sample is defined as follows:

SN R[i] = V Y [E [T[i]|Y ]] E Y [V [T[i]|Y ]] . ( 3
[i] = V Y [ψ(Y )[i]] V[Z[i]]
. In other words, this metric defines the ratio between the variance related to the targeted sensitive information and the variance of the noise. Thus, using the specific leakage metric is helpful for the Evaluator in order to directly assess the occurrence of points of interest for a given sensitive information. In a classical evaluation process, the Evaluator collects one or multiple leakage traces (see Figure 3.3) and identifies the different operation processed during the cryptographic function (e.g. encryption). In Figure 3.4a, a focus was made on the first AES's round. Hence, we can clearly evaluate all the operations performed during an AES encryption (i.e. SubBytes, ShiftRows, MixColumns and AddRoundKey). Once the Evaluator visualizes these operations, he can use a non-specific leakage metric to get a global overview of the behavior of the cryptographic module. In Figure 3.4b, the Evaluator observes that several leakages occur but cannot assess those depending on the sensitive variable. Furthermore, the Welch's T-test can sometimes be irrelevant for detecting some peaks. Indeed, for some informative samples, the mean values of the fixed and the random set of leakage traces can provide similar values which makes the detection of sensitive peaks impossible. Applying the statistical tool on large number of traces can be an effective solution to prevent this issue. During the evaluation process, the Evaluator can still consider the non-specific leakage metrics as an initial step to get a first insight of the cryptographic module's behavior. However, from the Evaluator point of view, the non-specific leakage metrics cannot be considered as a unique solution because it does not highlight the leakages that depend on the targeted sensitive information. Even if a SNR computation is more expensive than a non-specific approach [START_REF] Durvaux | From improved leakage detection to the detection of points of interests in leakage traces[END_REF], its application is mandatory to label the observed peaks and ease the resulted attacks. Indeed, as illustrated Figure 3.4c, we perform a leakage assessment on the AddRoundKey operation of an AES-128 encryption function. The results we obtain are in accordance with the AddRoundKey processing observed in Figure 3.4a. Hence, if the Evaluator wants to target the AddRoundKey operation, he can only focus its side-channel attack on the first 1, 000 time samples. This preprocessing can be highly beneficial to reduce the impact of irrelevant time samples regarding the targeted sensitive information and reducing the elapsed time of the related attack (see Section 3.3). The Welch's T-test can also be considered as a specific leakage metric [START_REF] Goodwill | A testing methodology for side-channel resistance validation[END_REF] but the SNR will be the only specific leakage metric we mention in this manuscript.

Once the Evaluator detects the dependence between the processed data and the resulted leakage trace, he can exploit them through different attack scenarios detailed in the following section.

Side-Channel Attacks

Optimal Attack

Scenario. To perform a side-channel attack, the Evaluator tries to exploit the dependence between a D-dimensional leakage trace T and a sensitive variable Y in order to extract the secret information brought by the deterministic part of Equation 3.1 (i.e. ψ(Y)). The targeted sensitive variable y = f (x, k * ) depends on a cryptographic primitive f (e.g. the output of the AES Sbox induced during the encryption of a plaintext x), on a public variable x ∈ X (e.g. plaintext or ciphertext) and on a part of the key k * ∈ K (e.g. a particular byte) that the Evaluator wants to retrieve. For such a purpose, he collects a set T of N leakage traces (t i ) 0≤i<N resulting from the computation of (f (x i , k * )) 0≤i<N such that (x i ) 0≤i<N is uniformly distributed over X . Then, each trace is labeled with its related sensitive variable such that he obtains the following set of labeled leakage traces T = {(t 0 , y 0 ), (t 1 , y 1 ), . . . , (t N -1 , y N -1 )}.

Because the Evaluator has access to the internal process of the targeted cryptographic function, the majority of side-channel attacks can follow the "Divide & Conquer" strategy which consists in targeting small independent part, known as sub-part, of the secret key (e.g. a byte of k * ). For example, if an AES-128 is considered, the Evaluator targets 16 sequences of 8 bits (i.e. (k * i ) 0≤i<16 ) instead of 1 sequence of 128 bits (i.e. k * ). It is beneficial to drastically reduce the key search space from 2 128 (black-box setting) to 2 8 . Hence, once the Evaluator recovers one secret's byte, he can replicate his attack on the other fifteen sequences in order to retrieve the whole secret key. This reduction makes the side-channel attacks particularly efficient performance-wise. The Evaluator's goal is to assess the security of a cryptographic module under side-channel attacks. Hence, he has to perform a global key recovery in order to fully evaluate the robustness of the device under test. However, while the goal of this thesis is to enhance the existing deep learning-based side-channel attacks, this manuscript will only consider the partial key recovery strategy assuming that our propositions can also be applied under a global key recovery strategy. In the rest of the manuscript, the secret key k * will interchangeably refer the whole secret as well as its subparts (k * i ) 0≤i<16 . It is typically considered in the side-channel literature as well as the security lab that a partial key recovery can be extrapolated to other parts of the secret key k * .

Based on this knowledge, the Evaluator tries to exploit the data dependence of the leakage trace with the help of statistical tools. Definition 3.3.1.3 (Distinguisher). A distinguisher, denoted D, is a function identifying the dependence between a set of leakage traces and the related sensitive information Y . Furthermore, it outputs an ordered score vector defining the likelihood of observing each key hypothesis k ∈ K.

Objective 3.3.1.1 (Optimal Adversary). Given a cryptographic module, the optimal Adversary aims at finding the distinguisher that recovers the secret key with a minimum number of attack leakage traces.

During the evaluation process, the Evaluator finds solutions to converge towards the optimal Adversary in order to strongly assess the security of the targeted device. In other words, he has to find the distinguisher suggesting the optimal Adversary. Definition 3.3.1.4 (Optimal Distinguisher [START_REF] Heuser | Good is not good enough[END_REF]). Given a set T of N leakage traces and a conditional probability distribution of observing a leakage T knowing a sensitive cryptographic primitive Y , denoted as Pr[T|Y ], we define the optimal distinguisher as:

D opt (T , k) = N -1 i=0 log (Pr [T = t i |Y = f (x i , k)]) .
If the chosen distinguisher is well suited, the Evaluator can compute the Distinguisher Rule arg max k∈K (D opt (T , k)) in order to output the most likely key candidate k. If k = k * , then, the optimal distinguisher succeeds to extract the targeted information from the cryptographic module. The main issue of Definition 3.3.1.4 is that the optimal distinguisher requires the real unknown leakage model in order to be computed. While this knowledge highly depends on the setup environment, one solution is to find the adequate estimation of Pr [T|Y ]. In the literature, this distinguisher can be defined by multiple tools.

MAIN RESULT IN SCA CONTEXT

Attack Categories. Classically, side-channel attacks can be decomposed into different categories depending on the targeted cryptographic implementation (i.e. symmetric vs. asymmetric algorithms) and the knowledge of the Evaluator:

• Simple side-channel attacks -The simple side-channel attacks consist of analyzing the operation flow in runtime of a cryptographic algorithm in order to retrieve the secret key. This strategy, called horizontal attack [Wal01, CFG + 10, BJPW13], consider a single trace to extract the manipulated sensitive variable. Mainly designed to defeat the asymmetric algorithms' implementation, the leakage trace is decomposed into several segments characterizing similar operations (e.g. modular exponentiation for RSA, scalar multiplication for ECC).

• Differential side-channel attacks -The differential side-channel attacks target the processed data. Based on several computations, the Evaluator performs vertical attacks which consist in collecting the related leakage traces and makes a guess about the manipulated secret key.

From this hypothesis, he can construct the corresponding sensitive variables and assigns a score to the guessed secret key which characterizing its statistical relation with the acquired leakage traces. The higher the score, the most likely the candidate (i.e. secret key).

The following sections explain the difference between those approaches in order to clarify these categories.

Simple Side-Channel Analysis

Originally described in [START_REF] Kocher | Timing attacks on implementations of diffie-hellman, rsa, dss, and other systems[END_REF], the Simple Power Analysis (SPA) is known as the simplest sidechannel attack. It consists in exploiting the security flaws of a cryptographic module by observing one or very few number of leakage traces. As mentioned in Subsection 3.1.1, the physical leakage of the device under test depends on the manipulated data. If the Evaluator is able to capture a key-dependent leakage trace, he may retrieve information about the secret. Such example is illustrated in Figure 3.5. Depending on the operation processed by the cryptographic module, the Evaluator identifies a difference on the resulted patterns. Based on this observation, he can guess the value of the manipulated secret's bit.

0 1 0 0 1 0 1 0 0 1 0 1 1 1 0 1 Figure 3.5: Simple Power Analysis (SPA) (k * = 0100101001011101).
This is a typical example of a SPA against RSA implementation based on the "Square & Multiply" algorithm d (see Algorithm 1). In this algorithm, the processing differs depending on the value of the secret's bit. While a bit value 0 considers a single operation (i.e. a modular square), a bit 1 value causes two operations (i.e. a modular square followed by a modular multiplication). Thus, the Evaluator can easily observe this difference on the resulted leakage trace such that the pattern related to the bit value 1 should be longer than the pattern related to the bit value 0. This attack was then extended to electromagnetic emanations [START_REF] Quisquater | Electromagnetic analysis (ema): Measures and counter-measures for smart cards[END_REF][START_REF] Gandolfi | Electromagnetic analysis: Concrete results[END_REF]. Similarly in ECC, the execution of a "Double & Add" algorithm involved in the point multiplication can be exploited by a SPA. Mostly dedicated to attack the asymmetric cryptographic algorithms, the SPA can be prevented by removing the dependence between computations and key bit values (see Algorithm 2). However, robust countermeasures exist to reduce the risk of SPA. Hence, the targeted cryptographic module is rarely vulnerable against this threat.

x d mod N R 0 ← 1, R 1 ← x; j ← n -1, i ← 0 ; while j ≥ 0 do R 0 ← R 0 × R i mod N ; i ← i ⊕ d[j]; j ← j -1 + i; end return R 0 ;
In most of the cases, the Evaluator has to deal with a large number of leakages traces (up to million leakage traces) in order to retrieve the secret key. In this setting, he has to conduct another strategy, namely Differential Side-Channel Analysis, consisting in the combination of leakage traces. d Among the numerous references an interested reader can refer for instance to [START_REF] Paar | Understanding Cryptography[END_REF] for details.

Differential Side-Channel Analysis

The basic idea of differential side-channel analysis is to gather the information of multiple leakage traces constructed from different inputs. As shown in Figure 3.6, the Differential Side-Channel Analysis (DSCA) attack can be described in four phases:

• Construction -Given a set of N plaintexts X = {x 0 , x 1 , . . . , x N -1 }, the Evaluator emits a hypothesis on the true unknown secret key k * . This key hypothesis, denoted k, is used to construct a set of label hypotheses {f (x 0 , k), . . . , f (x N -1 , k)}.

• Modeling -Based on the set of label hypotheses, the Evaluator models the expected leakage model for each sensitive variable (f (x i , k)) 0≤i<N . In some cases (e.g. [START_REF] Chari | Template attacks[END_REF]), the modeling phase can be done to capture both part of the leakage trace, namely the deterministic (i.e. ψ) and the random (i.e. Z) parts.

• Observation -In parallel of the Modeling phase, the Evaluator collects the related physical traces from the targeted cryptographic module considering X and an unknown fixed secret key k * as inputs.

• Exploitation -From the hypothetical leakage models and the related leakage traces, the Evaluator applies a chosen distinguisher to estimate if k equals k * .

Figure 3.6: Scenario of a differential side-channel attack (DSCA).

To retrieve k * , the Evaluator has to process these phases for each key hypothesis k ∈ K. Typically, to perform a differential side-channel attack, various scenarios can be considered by the Evaluator:

• Non-profiled vs. Profiled attacks -To perform a differential side-channel attack, the Evaluator targets a cryptographic module containing a secret key he wishes to retrieve. In the non-profiled scenario, he has the ability to send a request to the cryptographic module (e.g. a message) in order to acquire the resulting output (e.g. a ciphertext). From the physical properties of the device under test (e.g. power consumption, electromagnetic emanations), the Evaluator uses some statistical tools to extract its dependence with a targeted sensitive variable. In this scenario, the Evaluator does not have prior information on the leakage traces (i.e. leakage model). On the other hand, in the profiled scenario, it is assumed that the Evaluator has access to an open cryptographic module which is identical to the targeted one. In this configuration, the Evaluator decomposes the process into two phases: a profiling and an attack phase. In profiling phase, the evaluator gathers leakage information from the open copy of the cryptographic module in order to characterize Equation 3.1. Once the Evaluator learns how the leakage trace behaves, he gathers leakage information from the targeted cryptographic module focusing on the identical, but now unknown Y . However, based on the knowledge he acquired in the profiling phase, the Evaluator can emit some assumptions on the sensitive variable Y processed. This scenario is considered as the most critical from an evaluation point of view.

• Univariate vs. Multivariate attacks -Given a D-dimensional leakage trace T, the Evaluator can assess the security flaws of the targeted cryptographic module based on leakage metrics defined in Subsection 3.2.2. Hence, he extracts a vector of index where the impact of ψ(Y ) is non-negligible. This vector lists all the points of interest induced in the leakage trace. If the Evaluator chooses to exploit the information from a single element of this list, it aims at performing an univariate side-channel attack. This time sample can be selected depending on the result the Evaluator obtained from a specific leakage metric. In a multivariate e side-channel attack, the Evaluator exploits multiple coordinates from the PoIs' vector in order to retrieve information about the targeted variable Y . The strategy can be chosen depending on the attack scenario (i.e. profiled vs. non-profiled attack) or the countermeasures implemented (see Section 3.4).

Non-profiled Attacks. As mentioned, a non-profiled side-channel attack relies on the ability of the Evaluator to extract the sensitive information from one or multiple leakage traces without any prior knowledge on the related leakage model. They are mostly univariate (i.e. D = 1) and take into account all the time samples independently. Hence, the selected distinguisher is performed successively on each of those samples and select the one that facilitates the key extraction.

The first non-profiled attack proposed in the literature is the difference of means (DoM) [START_REF] Kocher | Differential power analysis[END_REF]. Kocher et al. selected the mono-bit leakage model to extract the sensitive information from the leakage traces. Given a key hypothesis k ∈ K, the Evaluator partitions the leakage traces into two subsets according to the value of the j th bit of Y (denoted as Y [j]). Then, he estimates the difference between the subsets for each k ∈ K and defines the argmax as the secret key.

Definition 3.3.3.1 (Difference of Means Distinguisher). Given a set T of 1-dimensional leakage traces labeled from a key hypothesis k ∈ K, a set of plaintext X and a targeted bit index j, the difference of means distinguisher is defined as:

D DoM (T , X , k, j) = N -1 i=0 f (x i , k)[j] • t i N -1 i=0 f (x i , k)[j] - N -1 i=0 (1 -f (x i , k)[j]) • t i N -1 i=0 (1 -f (x i , k)[j]) ,
where f : X × K → Y denotes the targeted cryptographic primitive.

For correct key guessed arg max

k∈K (D DoM (T , X , k, j)) = k * , D DoM (T , X , k, j) converges towards the true unknown E [T|f (X, k * )[j] = 0] -E [T|f (X, k * )[j] =
D CP A (T , X , k, ψ) = Cov T , ψ(f (X, k)) σ T • σ ψ(f (X,k)) ,
where f : X × K → Y denotes the targeted cryptographic primitive.

e For the sake of simplicity, the described approach focuses on attack targeting a single sensitive variable. However, more sophisticated attacks, such as higher-order attacks (see Section 3.5), may exploit simultaneously multiple leakages related to several sensitive variables.

A value close to -1 or 1 indicates a strong linear dependence between the measurements and the related leakage model of Y . An alternative to the CPA is the correlation electromagnetic analysis (CEMA). It results from a substitution between power and electromagnetic emanations channels. In opposition, a correlation coefficient close to 0 reveals the absence of dependence between these data. Consequently, the Evaluator considers the key hypothesis k maximizing the amplitude of the coefficient correlation as the secret key k * . While the CPA perfectly fits for detecting linear dependence between the measurements and the chosen leakage model, it does not capture the non-linear dependencies. To circumvent this issue, Gierlichs et al. introduce the mutual information analysis (MIA) [START_REF] Gierlichs | Mutual information analysis[END_REF] as an alternative distinguisher exploiting any kind of dependencies between the leakage traces and the leakage model. Definition 3.3.3.3 (Mutual Information Distinguisher). Given a set T of 1-dimensional leakage traces labeled from a key hypothesis k ∈ K, a set of plaintext X and a predicted leakage model ψ, the mutual information distinguisher is defined as:

D M IA (T, X , k, ψ) = H [T] -H T| ψ(f (X, k)) .
The key guess maximizing the mutual information analysis is the one minimizing the conditional entropy H T| ψ(Y ) such that Y = f (X, k). Hence, an estimation of the Probability Density Functions (PDFs) of the conditional leakages (i.e. (T| ψ(f (X, k)))) should be computed for each key hypothesis k in order to perform the attack. However, this estimation needs to choice an appropriate methods such as histograms, kernel density function, or parametric estimation. However, selecting the appropriate method can be very challenging. This reason leads the side-channel community to mainly consider the CPA to perform non-profiled attacks.

Profiled Attacks. As mentioned, the profiled attacks aim at characterizing the behavior of the cryptographic module under test. Such a setting requires the ability to acquire a clone of the device such that the data and the key can be fully configured by the Evaluator. While the Modeling phase of non-profiled attacks consists in selecting the correct unknown leakage model ψ, in profiled attacks, this phase suggests the estimation (or profiling) of the PDFs (Pr [T = t|Y = y]) y∈Y , i.e. estimates the likelihood of a key guess k ∈ K such that, from the Bayes' Theorem, we have:

Pr [T = t|Y = f (x, k)] = Pr [Y = f (x, k)|T = t] • Pr [T = t] Pr [Y = f (x, k)] . (3.3)
If k is assumed to be uniformly distributed, Equation 3.3 can be simplified as:

Pr [T = t|Y = f (x, k)] = • Pr [Y = f (x, k)|T = t] , (3.4)
where denotes a constant independent of k.

Definition 3.3.3.4 (Log-Likelihood Distinguisher). Given a set T of N leakage traces labeled from a key hypothesis k ∈ K and a set of plaintext X , the Log-Likelihood distinguisher can be computed from a set of estimated PDFs, denoted ( Pr [T|Y = y]) y∈Y , as:

D LL (T , X , k) = N -1 i=0 log Pr [T = t i |Y = f (x i , k)] -log ( ) .
While does not depend on k, it is usually ignored by the log-likelihood distinguisher. The curse of Dimensionality. The practical issue of the profiled and non-profiled attacks is the selection of the points of interest. Indeed, side-channel measurements acquired with an oscilloscope consist of thousands or even millions of time samples. These huge dimensional leakage traces can be problematic from a practical perspective as the risk of exploiting non-informative time samples increases. Consequently, the larger the dimension D, the larger this risk. Thus, from a practical perspective, the Evaluator has to find solution to focus its attack only on the informative time samples (i.e. PoIs). To conduct such approach, he can reduce the dimensionality of the leakage traces through multiple scenarios. Furthermore, reducing the amount of time samples can be highly beneficial to accelerate the attack process and thus, to minimize the elapsed time (see Subsection 1.2.2) attribute.

One solution to perform dimensionality reduction is based on the specific leakage metrics. In this scenario, the Evaluator can assess the time samples influenced by a targeted sensitive variable. For example, once a SNR computation is performed (see Figure 3

DIMENSIONALITY REDUCTION

In this manuscript, we mainly focus on the vertical multivariate profiled attack because it corresponds to one of the highest risks from an attack perspective. However, how does the Evaluator can evaluate if the performed attack retrieves the correct secret key? Which solutions should be considered? In which scenario? The following section tries to answer these questions.

Performance Metrics

To assess the security of the cryptographic module, the Evaluator has to evaluate the robustness of the device against side-channel attacks. For such purpose, the literature introduced some performance metrics to define the feasibility of a successful attack. In this manuscript, the definition

s Na (D LL , k) = Na-1 i=0 log Pr [T = t i |Y = f (x i , k)] , (3.5)
where ( Pr [T|Y = y]) y∈Y denotes a set of estimated PDFs (see Definition 3.3.3.4).

The variable g Na (D, k ) defines the position of a given hypothetical key k , in g Na , amongst all hypotheses. We consider g 1 Na as the most likely candidate and g |K| Na as the least likely one.

Definition 3.3.4.1 (Rank). The rank, defined by g Na (D, k * ), measures the position of the secret key k * in g Na .

The rank of the correct key gives to the Evaluator an insight into how well the selected distinguisher performs. Broadly, the rank decreases as the attack becomes better and reaches one if it can recover the correct key hypothesis.

The first used evaluation metric introduced in the literature was the stability criterion [START_REF] Standaert | Improving the rules of the dpa contest[END_REF] that consists in determining the minimum number of leakage traces that are needed to continuously retrieve k * (i.e. rank equals 1) when accumulating the attack traces. However, this metric can be questioned. Indeed, if the distinguisher rule outputs the correct key hypothesis 99% of the time, the targeted cryptographic module is considered as secure while it is not indisputable.

RE(D, N a ) = E [log 2 (g Na (D, k * ))] .
In the security laboratories, the ranking entropy is also known as the remaining entropy. These metrics, i.e. Success Rate, Guessing Entropy and Ranking Entropy, are often defined in an empirical way by computing them several times over different sets of leakage traces collected from the same targeted cryptographic module in order to construct security graphs [START_REF] Veyrat-Charvillon | Security evaluations beyond computing power[END_REF]. A special feature of the security graphs is the indication of the probability that a key will be found, depending on the amount of keys that the Evaluator can enumerate. However, as mentioned in Subsection 3.3.1, this thesis only considers the partial key recovery strategy, and consequently, cannot fully exploit the benefits of the security graphs introduced in [START_REF] Veyrat-Charvillon | Security evaluations beyond computing power[END_REF]. Instead, we consider partial security graph plotting the rank evolution of a targeted key byte. An example of such partial security graph is given in Figure 3.7. Given an unprotected AES-128 implementation, we perform 10 successive CPA against the AddRoundKey operation considering sets of different leakage traces and we report the rank evolution of the correct secret key byte into 10 vectors (one vector for each attack). In Figure 3.7, the red curve illustrates the mean rank evolution of this byte on 10 attacks while the dotted black (resp. dotted white) curve indicates the 5 th (resp. 95 th ) percentile of the rank evolution. The area around the red curve indicates a non-negligible probability of successful attack. In this manuscript, the partial security graphs will be considered as the most likely performance metric when the targeted cryptographic module implements a symmetric algorithm.

Asymmetric cryptographic implementations.

For asymmetric cryptographic implementations, we define a key recovery attack using a distinguisher D as successful attack if, for one or few attack traces, the Evaluator retrieves the whole private key s k * ∈ F n 2 . Indeed, due to a careful combination of countermeasures (see Subsection 3.4.1), the Evaluator must be able to recover most of the private bits with one or a few leakage traces capturing the cryptographic process (e.g. signature). Consequently, his strategy differs from the symmetric cryptographic implementations. While an attack against symmetric cryptographic implementations computes the score from a distinguisher over multiple traces, the Evaluator cannot consider the performance metrics previously designed. Let T be a set of leakage traces labeled from the same private key s k * ∈ F n 2 . Hence, each trace included in T is related to a single bit of (s k * [i]) 0≤i<n .

Definition 3.3.4.5 (Accuracy). Given a set T of n leakage traces, a distinguisher D defining a score related to each leakage trace (t i ) 0≤i<n and a private key s k * ∈ F n 2 , the accuracy of D is defined as:

Acc(T , D, s k * ) = 1 n n-1 i=0 1 arg max k∈{0,1} (D(ti,k))=s k * [i]
The accuracy describes the ability of the distinguisher D to correctly map a leakage trace to its related private key bit (s k * [i]) 0≤i<n . If the resulted accuracy is less than 100%, the Evaluator has to perform additional operations to retrieve the full private key.

Definition 3.3.4.6 (Remaining Operations). Given a set T of n leakage traces and a distinguisher D resulting in an accuracy of α, the remaining operations N op,α defines the number of operations the Evaluator has to perform in order to retrieve the remaining bits of the private key s k * .

The European SOG-IS scheme considers that a maximum brute-force complexity of around 2 100 remaining operations is practical. Hence, this manuscript considers this threshold to evaluate if an attack becomes feasible against asymmetric cryptographic implementations. Note that the notion of time complexity is independent of the computational power available to the attacker. In addition, even if no theoretical results link the accuracy with the remaining operations, it sounds evident that a correlation between both metrics exist. Chapter 8 experimentally validates this intuition. Hence, increasing the accuracy of a side-channel attack is crucial in order to reduce the remaining operations required to find the entire private key.

For ensuring the robustness of the cryptographic modules against physical attacks, the Developer has to implement some countermeasures in order to harden the leakage exploitation. Hence, the side-channel community designs countermeasures in order to reduce the relation between the leakage traces and the processed data.

Side-Channel Countermeasures

Following [START_REF] Shirey | Internet security glossary[END_REF], a countermeasure can be defined as:

"An action, device, procedure, or technique that reduces a threat, a vulnerability, or an attack by eliminating or preventing it, by minimizing the harm it can cause, or by discovering and reporting it so that corrective action can be taken."

In the following, we review the most common countermeasures against side-channel attacks. Typically, these countermeasures can be decomposed into two categories: data randomization and hiding.

Data Randomization

Randomization for block ciphers. For block cipher implementations, one solution consists in using masking schemes. This countermeasure consists in breaking the dependency between the targeted sensitive variable Y ∈ F n 2 and the secret key by integrating multiple shares. The shares' integration is beneficial to make the sensitive variable independent from the secret key. Based on the d-probing secure circuit of Ishai et al. [START_REF] Ishai | Private circuits: Securing hardware against probing attacks[END_REF], the masking schemes are designed such that during the computation, the d shares {Y 0 , Y 1 , . . . , Y d-1 } occurring reveal no information about the secret. The main idea is to randomly split a secret into several shares such that the Evaluator needs all of them to reconstruct the secret. Hence, given a group operation ⊥, the following relation should be satisfied:

Y 0 ⊥ Y 1 ⊥ . . . ⊥ Y d-1 = Y, (3.7)
where the d -1 shares {Y 1 , Y 2 , . . . , Y d-1 }, known as masks, are independent and randomly distributed over F n 2 while Y 0 , known as the masked variable is processed such that the masking scheme is satisfied (i.e. Equation 3.7). Definition 3.4.1.1 (d th -Order Masking). A d th -order masking describes a masking scheme inducing d masks.

In the literature, different operations ⊥ have been introduced, notably, the XOR operation [GP99, CJRR99], the modular addition [START_REF] Messerges | Securing the aes finalists against power analysis attacks[END_REF], multiplicative [START_REF] Golić | Multiplicative masking and power analysis of aes[END_REF] or the affine scheme [START_REF] Von | A technique with an information-theoretic basis for protecting secret data from differential power attacks[END_REF][START_REF] Fumaroli | Affine masking against higher-order side channel analysis[END_REF].

In this manuscript, a particular focus will be made on the Boolean Masking Scheme. In this scheme, the invertible operation ⊥ is defined by a XOR operation in F 8 2 , denoted ⊕. Proposed by Goubin and Patarin [START_REF] Goubin | Des and differential power analysis the "duplication" method[END_REF], and Chari et al. [START_REF] Chari | Towards sound approaches to counteract power-analysis attacks[END_REF], this is the most classical masking scheme used in practice due to its simple hardware/software implementation. The computation performed on the masks and the masked variable should be computed in order to satisfy Equation 3.7. An example of 1 st order Boolean masking scheme is presented in Figure 3 The soundness of the masking schemes was formally demonstrated by Chari et al. [START_REF] Chari | Towards sound approaches to counteract power-analysis attacks[END_REF]. They establish that the number of leakage traces that are needed for defeating such implementations increases exponentially with the number of shares. More precisely, for a d-order masking scheme, they assume that each share is modeled as T i = Y i + Z i such that the noise (Z i ) 0≤i<d follows a Gaussian distribution N (µ, σ 2 ). Hence, the number of attack traces is proportional to σ d . Many papers have been proposed as an extension of this seminal work [PR13, DDF14, DFS15, DFS18]. As a result, the side-channel attacks exploiting a single sensitive variable cannot be performed anymore. A solution suggests the application of high-order side-channel attacks targeting multiple sensitive variables simultaneously (see Section 3.5).

Randomization for asymmetric algorithms. As illustrated in Subsection 3.3.2, the asymmetric algorithms' implementation can be vulnerable to SPA due to the conditional branch induced in the modular exponentiation (e.g. RSA implementation, see Algorithm 1) or in the scalar multiplication (e.g. ECC implementation). In order to reduce this limitation, the literature proposes some countermeasures. A first countermeasure consists of preventing the conditional branch dependence by performing the same operations independently of the value of the current bit. This solution can be brought by the Multiply Always algorithm (see Algorithm 2), the Montgomery Ladder or the Double & Add Always algorithm. However, such countermeasure is still vulnerable against differential attacks [START_REF] Coron | Resistance against differential power analysis for elliptic curve cryptosystems[END_REF]. Hence, as for the symmetric case, the side-channel community proposes to randomize the manipulated data in order to reduce the dependence between the sensitive variable and the leakage trace by using blinding schemes. However, depending on the targeted asymmetric algorithm, the countermeasure differs. In RSA algorithm, let sign = x s k * mod N be the signature of a message x given a private key s k * and a modulus N . To make a RSA-CRT implementation robust against side-channel attacks, the Developer can implement the following blinding countermeasures:

• Exponent blinding [START_REF] Kocher | Timing attacks on implementations of diffie-hellman, rsa, dss, and other systems[END_REF] -If the same private key s k * is used to compute several signatures, the Developer can generate any random positive integer r such that:

sign = x s k * mod N = x s k * +r•(q-1)(p-1) mod N.
Hence, for each signature computation, a new random value r is picked in order to reduce the dependence between the private key s k * and the related leakage trace. A similar solution the Developer can consider is the exponent splitting [START_REF] Clavier | Universal exponentiation algorithm a first step towards provable spa-resistance[END_REF].

• Message blinding [MDS99] -The idea is to transform the message x in such a way that the Evaluator cannot perform, for example, a multiple-exponent, single-data (MESD) a zeroexponent, multiple-data (ZEMD) attack [START_REF] Messerges | Power analysis attacks of modular exponentiation in smartcards[END_REF] or a doubling attack [START_REF] Fouque | The doubling attack -why upwards is better than downwards[END_REF]. Given r 1 and r 2 , two random position integers, it can be computed based on the following equation:

sign = x s k * mod N = ((x + r 1 • N ) s k * mod r 2 • N ) mod N.
Combination of these countermeasures can be beneficial for reducing the risks of security flaws. For the ECC algorithms, an analogy can be made with the point blinding and the scalar blinding as fruitful countermeasures. The list introduced in this section represents a non-exhaustive enumeration of the possible attacks and countermeasures against RSA and ECC. The interested readers may refer to [FV12, DGH + 13, AFSW13, FGI + 16] for additional information.

Hiding

In addition to the data randomization, the hiding mechanisms are widely used as countermeasures which can be included in hardware or in software cryptographic implementations. As defined in Subsection 3.2.2, the Evaluator aims at identifying the time samples where the sensitive variable leaks in order to extract the information related to the manipulated secret key. The goal of hiding is to distribute the execution of the sensitive variables over different periods of time. The distribution should neither be predictable nor be observable by the Evaluator. If the leakage traces are perfectly synchronized, the probability of observing the execution of a given cryptographic operation for a period of time is nearly 1 while the hiding mechanisms reduce this probability. The higher the hiding level, the lesser the probability of observing the execution of a given cryptographic operation for a certain period of time. Therefore, it significantly reduces the correlation between the targeted sensitive variable and the time samples where it leaks. This countermeasure reduces the Signal-to-Noise Ratio (see Equation 3.2) by increasing the related noise without eliminating the informative signal itself. It differs from the masking countermeasures which reduce correlation between the leakage traces and the sensitive variables by splitting it over multiple shares. In the literature, several hiding techniques have been introduced:

• Adding Noise -One classical countermeasure generates some noise in the leakages trace in order to increase the SNR value. The cryptographic module performs unrelated operations when the relevant computation is being conducted. The sensitive information included in the leakage trace is thus polluted by the irrelevant operations. This countermeasure is considered as a moderate way for reducing the security flaws because the electromagnetic emanation analysis can capture a very local signal that is not affected by the unrelated operations.

• Random Process Operations [CCD00] -It is based on the insertion of dummy instructions so that the corresponding operation cycles do not match between the leakage traces. A straightforward method consists in randomly picking up a number of dummy instructions in an interval [0, α], with α ∈ N. Some methods were proposed in order to efficiently insert random delay in software implementations [START_REF] Tunstall | Efficient use of random delays in embedded software[END_REF][START_REF] Coron | An efficient method for random delay generation in embedded software[END_REF] such as the insertion of NOP instructions. In hardware level, the random process operation can be formulated as a jitter generated through unstable clock frequency.

• Dummy Operations -This approach randomly inserts meaningless operations, which do not influence the targeted cryptographic function (e.g. encryption, decryption), amongst sensitive operations. The 1-amongst-n countermeasure is a classical example. It consists of executing the computation of the sensitive variables randomly amongst (n -1) fake operations. In opposition to the random process operations, the Evaluator cannot distinguish the dummy operations from the real one.

• Shuffling [HOM06] -It consists in randomizing the order of independent operations. This countermeasure limits the ability of the Evaluator to assess the time samples where the sensitive variable is manipulated. As an example, the SubBytes operations of an AES implementation are independent and thus, can be permuted in an arbitrary order.

• Balancing -This countermeasure aims at making the activity of the physical implementation independent of the sensitive variables. Applied at the logic gate level, it adds complementary logic to the existing one in order to make the activity of the cryptographic module constant [MAM + 03, TV03, CZ06].

• Shielding -To prevent hide the internal behavior of the chip, this countermeasure proposes to insert circuit and wire shielding, such as a Faraday cage, in order to reduce and filter the signal. Hence, the Evaluator cannot exploit the dependence between the data manipulated by the cryptographic module and the related power consumption.

Hiding countermeasures do not make the attack theoretically unfeasible but increase the number of attack leakage traces considerably. Indeed, from an evaluation perspective, these countermeasures highly impact the time requires to perform a successful attack, i.e. elapsed time, and thus, makes a cryptographic module robust regarding the certification schemes. However, these countermeasures can be mitigated with a preprocessing phase consisting in applying some signal processing tools such as filtering, pattern detection, signal transformation, synchronization, etc. While most of the Evaluator's time consists in optimizing the preprocessing phase in order to perform successful attacks, some tools have been designed to limit the desynchronization effect, e.g. phase-only correlation [HNI + 06], the amplitude-only correlation [START_REF] Guilley | Formal framework for the evaluation of waveform resynchronization algorithms[END_REF], dynamic time warping [START_REF] Jasper Van Woudenberg | Improving differential power analysis by elastic alignment[END_REF].

Most of the real-life protected cryptographic modules implement a mixture of multiple hiding and masking countermeasures in order to make the side-channel attacks challenging. In this thesis, we only consider the random delay interrupt as a source of hiding while the masking scheme that we have to deal with is the Boolean masking scheme.

High-Order Side-Channel Analysis

In Subsection 3.4.1, the masking countermeasures have been introduced to split a sensitive variable into

d shares {Y 0 , Y 1 , . . . , Y d-1 }.
To counteract the effectiveness of the masking schemes, the Evaluator can perform a High-Order Side-Channel Attack (HO-SCA) for retrieving the secret key manipulated by the cryptographic module. Let the masking scheme be Boolean, M = {m 1 , m 2 , . . . , m d-1 } be a set of d -1 random masks and Y the targeted sensitive variable such that:

Y i = Y ⊕ m 1 ⊕ . . . ⊕ m d-1 if i = 0, m i otherwise.
Definition 3.5.1 (d th -Order Attack). A d th -Order Attack refers the order of the statistical moment related to the leakage distribution that is exploited during the attack.

If no masking schemes are implemented, the sensitive variable is unprotected. Thus, a 1 st -order attack exploits the mean (i.e. the first moment) of the leakage distribution to extract the sensitive variable. Similarly to a 1 st -order side-channel attack, when the Evaluator wants to perform a high-order attack, he aims at targeting the unmasked sensitive variable Y . However, Y is not directly observable through side-channel measurements because of the masking scheme contrary to its related PDFs. If Y is split into d shares {Y 0 , . . . , Y d-1 }, the Evaluator has to perform a (d + 1) th order attack in order to reveal the sensitive information Y . If the modeling of the shares (T i = Y i + Z i ) 0≤i<d is independent, then the Evaluator must combine the leakages of different shares and he has to estimate a high-order moment of the leakage distribution. Typically, classical approaches considered in profiled side-channel attacks use some combining functions as preprocessing. This approach involves the combination of the d shares in order to reveal the dependence of the leakage traces and the related sensitive variable Y . To apply this proposition, various combining functions C(Y 0 , Y 1 , . . . , Y d-1 ) are introduced:

• Product combining [CJRR99] -Proposed by Chari et al., this combination function multiplies the shares such that:

C prod (Y 0 , . . . , Y d-1 ) = T 0 × . . . × T d-1 . (3.8)
• Absolute difference combining [Mes00] -Introduced by Messerges, it computes the absolute difference between the shares and can be expressed as follows:

C abs.dif f (Y 0 , . . . , Y d-1 ) = |T 0 -T 1 | -T 2 | . . . | -T d-1 |.
(3.9)

• Optimal product combining [PRB09] -Prouff et al. expressed it as the centered product of the shares:

C opt.prod (Y 0 , . . . , Y d-1 ) = (T 0 -E[T 0 ]) × . . . × (T d-1 -E[T d-1 ]). (3.10)
In [START_REF] Prouff | Statistical analysis of second order differential power analysis[END_REF], the authors demonstrate the benefits of using the optimal product combining function if the leakage model ψ of the processed sensitive variables is the Hamming Weight. In addition, they suggest that under a very noisy model, the number of side-channel measurements required to retrieve the secret key is greater when the absolute difference combining function is considered. Other combining functions have been proposed in the literature [JPS05, OM06] but stay out of the scope of this manuscript. Once these combinations functions are used as preprocessing, the Evaluator can perform the classical side-channel attacks as defined in Subsection 3.3.3.

To assess the benefits of new contributions, the side-channel community mainly applies their related propositions on a wide range of implementations that we describe in the next section.

Those datasets are also considered in the rest of this manuscript.

Presentation of the Datasets

The datasets, introduced in this section, are beneficial to experimentally validate the theoretical observations we will make. We use eight different implementations with a wide range of use cases.

Six datasets correspond to symmetric cryptographic implementations related to the Advanced Encryption Standard. These datasets offer a wide range of use cases: simulations, high-SNR f unprotected implementation on a smart card (i.e. Chipwhisperer and DPA contest-v4), low-SNR unprotected implementation on a FPGA (i.e. AES_HD), low-SNR protected implementation with first-order masking (i.e. ASCAD) and desynchronization with a random delay (i.e. AES_RD).

The other datasets implements protected public-key algorithms, namely RSA and ECC.

Simulations. First, this dataset considers simulations of D-dimensional leakage traces from a 8-bit sensitive variable Y . In this manuscript, the simulated leakage traces are built such that for every time sample i ∈ [0, D -1], the j th leakage trace t j is defined as follows:

t j [i] = ψ(y j )[i] + z j [i] if i ∈ {l 0 , . . . , l u-1 }, z j [i] otherwise,
where {l 0 , . . . , l u-1 } defines a set of indices related to each point of interest, ψ(y j )[i] denotes the leakage model constructed from y j ∈ F n 2 that depends on the secret key k * j . Finally, z j defines the noise following a Gaussian distribution N (0, σ 2 ). The noise as well as the leakage model considered in this manuscript will be specified each time the simulation leakage traces will be applied.

ChipWhisperer is an unprotected emulation of AES-128 implemented in software on a Chipwhisperer board [START_REF] Flynn | Chipwhisperer: An open-source platform for hardware embedded security research[END_REF] which corresponds to a ATxMega-128D4, which is composed by a 8-bit microcontroller g . Due to the lack of countermeasures, the Evaluator can recover the secret key directly. In this experiment, we attack the first round S-box operation. We identify each leakage trace with the sensitive variable Y = Sbox[X[0]⊕k * ] where X[0] denote the first byte of the plaintext such that the measured SNR equals 7.767 (see Figure 3.9b). The experiences introduced in this manuscript are conducted with 100, 000 leakage traces of 800 time samples (see Figure 3.9a). DPA contest-v4 is a protected AES-128 implemented in software on an Atmel ATMega-163 smart card, which is composed by a 8-bit AVR microcontroller [BBD + 14] h . In order to prevent first-order attack, the Developer protects the implementation with a first-order Boolean masking scheme. However, for this dataset, we assume that the Evaluator knows the mask manipulated by the targeted cryptographic module. Hence, this strong assumption reduces the protection of the implementation such that a first order attack can be performed. Thus, this implementation can be considered as unprotected. In this manuscript, we attack the first round Sbox operation. Hence, each leakage trace T is labeled with its corresponding sensitive variable Sbox[X[0] ⊕ k * ] ⊕ M where M denotes the known mask and X[0] the first byte of the plaintext manipulated by the cryptographic module. The related dataset is composed by 5, 000 leakage traces. Each leakage trace has 4, 000 time samples (see Figure 3.10a) and the highest SNR targeting the sensitive variable with known mask equals 4.33 (see Figure 3

.10b).
AES_HD is an unprotected AES-128 implemented on Xilinx Virtex-5 FPGA. Introduced in [PHJ + 18] i , the authors decided to attack the register writing in the last round such that the label of a leakage trace T can be described as Sbox

-1 [C[j] ⊕ k * ] ⊕ C[j ]
where C[j] and C[j ] are two ciphertext bytes associated with the leakage trace T, and the relation between j and j is given by the ShiftRows operation of AES. The authors use j = 12 and j = 8. This dataset is composed by a set of 75, 000 leakage traces. Each leakage trace has 1, 250 time samples (see Figure 3.11a) and the highest SNR targeting the sensitive variable equals 0.01554 (see Figure 3.11b).

AES_RD is an AES-128 obtained from an 8-bit Atmel AVR microcontroller, protected by a random delay countermeasure that inserts a random number of dummy operations which is determined by a RNG [CK09] j . This countermeasure shifts each trace following a random variable. This renders the attack more difficult because of the misalignment. Like DPA-contest v4, the sensitive variable is the first round Sbox operation where each leakage trace T is labeled as such Sbox[X[0] ⊕ k * ]. This dataset contains 50, 000 leakage traces of 3, 500 time samples (see Figure 3.12a) and the SNR targeting the sensitive variable does not identify any relevant leakages (see Figure 3.12b). This phenomenon can be explained by the implementation of the random delay. + 20] and is the first open database k that has been specified to serve as a common basis for further works on the application of deep learning techniques in the side-channel context l . The target platform is an 8-bit AVR microcontroller (ATmega8515) where a masked AES-128 is implemented. In order to prevent first-order attack, the Developer protects the implementation with a first-order Boolean masking scheme. The targeted sensitive variable is the third byte of the first round Sbox operation. Consequently, each leakage trace is labeled as follows:

ASCAD-v1 is introduced in [BPS

Y = Sbox[X[3] ⊕ k * ].
While no leakages characterizing Y are observed (see Figure 3.13b), the Evaluator or the neural network has to combine an unknown mask, denoted r3 and the related masked value, denoted Sbox[X[3] ⊕ k * ] ⊕ r3, in order to perform a high-order side channel attack. The SNR peaks of the mask, the masked value and the unmasked value are illustrated in Figure 3.13b. This dataset is interesting to assess the ability of a neural network to retrieve Y without any assumption on the unknown mask. In order to make the attack even more difficult, two additional ASCAD datasets have been proposed with an artificial shift of maximum amplitude of 50 and 100 time samples. The ASCAD-v1 dataset contains 60, 000 such that each of them has 700 time samples m (see Figure 3.13a).

k https://github.com/ANSSI-FR/ASCAD l Recently, a new dataset known as ASCAD-v2 has been released [START_REF] Masure | Side channel analysis against the anssi's protected aes implementation on arm[END_REF]. This implementation is out of the score of this document.

m A new version randomizes the keys used in the training set. The resulted leakage traces are twice larger. However, this version is not investigated in this thesis. ) combined with exponent and message blinding. This implementation runs on a 0.13um 32-bit contact Smartcard IC. The software part of the targeted RSA implementation does not provide specific security mechanisms to defeat horizontal or address-bit side-channel attacks. This choice has been done deliberately by CryptoExperts' team n who was responsible for the development of the RSA software part. In [CCC + 19], the authors highlight that the application of advanced deep learning-based side-channel attacks makes security mechanisms against horizontal and address-bit attacks mandatory to reduce the Evaluator's scope. For two 512 bits primes p and q, the combination of the three masking countermeasures corresponds to the following equation:

m d mod N = ((m + k 1 • N ) s k * +k2•φ(N ) mod (k 0 • N )) mod N,
with k 0 , k 1 , k 2 three random values of bit-length 64, N = p × q the modulus of 1, 024 bits. In the Square & Multiply Always algorithm (see [CCC + 19, Algorithm 1]), Carbone et al. identify a vulnerability related to the manipulation of an index named seg f ree . Indeed, this index stays unchanged for two consecutive exponentiations if the related exponent bit equals 1. If the Evaluator retrieves the value of this index, he can gradually learn the entire exponent bits except for the last one. For each leakage trace, this index value is defined in 0, 1, 2 (see [CCC + 19, Equation 5]). For a complete overview of the device under test, we suggest that the readers refer to [CCC + 19]. The related dataset is composed by 43, 880 leakage traces of 13, 000 time samples (see Figure 3.14a) and the related SNR computation is defined in Figure 3.14b.

Secure ECC. Defined in [START_REF] Nascimento | Attacking embedded ecc implementations through cmov side channels[END_REF], the secure ECSM (Elliptic Curve Scalar Multiplication) algorithm has been implemented in an 8-bit ATmega328P microcontroller [START_REF] Chmielewski | Reassure (h2020 731591) ecc dataset[END_REF]. This implementation is constructed from Curve25519 [START_REF] Bernstein | Curve25519: New diffie-hellman speed records[END_REF] which is a 255-bit elliptic curve. More precisely, this curve is defined by the equation y 2 = x 3 + 486662 • x 2 + x over the prime field defined by the prime number 2 255 -19 and it uses the base point x = 9. It generates a cyclic subgroup whose order is the prime 2 252 + 27742317777372353535851937790883648493 and cofactor 8. To protect its implementation, the Developer employs the Montgomery Ladder with randomized projective coordinates and a conditional swap (cswap) (see [NCOS17, Algorithm 1]). Starting from two (or more) curve points, the cswap countermeasure performs the scalar multiplication algorithm on one of these points depending on a mask value. Hence, if the Evaluator learns all the conditional swap bits from one side-channel trace, he retrieves the secret key (i.e. 256 bits) [START_REF] Nascimento | Attacking embedded ecc implementations through cmov side channels[END_REF]. To be successful, the secret bits have to be recovered from a single side-channel trace. In the dataset, each leakage trace represents a single iteration of the Montgomery Ladder scalar multiplication (see Figure 3.15a) and the related label corresponds to the cswap condition bit value. For deeper information on the device under test, we suggest that the readers refer to [START_REF] Nascimento | Attacking embedded ecc implementations through cmov side channels[END_REF][START_REF] Chmielewski | Reassure (h2020 731591) ecc dataset[END_REF]. The related dataset contains a set of 24, 560 leakage traces of 5, 500 time samples (see Figure 3.15a) and the related SNR computation is defined in Figure 3.15b.

Conclusion

This chapter introduces the side-channel attacks that are considered in this thesis. The scenario of such attack is summarized in Figure 3.16. From the physical consumptions (e.g. power consumption, electromagnetic emanations) of a cryptographic module, the Evaluator identifies the time samples where a sensitive variable is manipulated (see Subsection 3.2.2). Based on this knowledge, he can use statistical tools to approximate the optimal distinguisher (see Definition 3.3.1.4). Typically, two strategies can be considered: non-profiled vs. profiled side-channel attacks. While the first approach consists in targeting a cryptographic module without any prior knowledge on the related leakage model, it is classically considered as less efficient than profiled side-channel attacks which assume a stronger Evaluator. In the latter scenario, the Evaluator has access to an open copy of the device in order to characterize the behavior of the leakage traces defined in Equation 3.1. This characterization is helpful to approximate the optimal distinguisher through the log-likelihood distinguisher (see Definition 3.3.3.4).

However, from a practical perspective, this solution has some limitations. Indeed, the characterization of the leakage traces requires a preprocessing phase that reduces the dimensionality of the leakage traces in order to ease the computation process. In addition, to reduce the risk of sidechannel attacks, the community introduces different countermeasures, namely data randomization (see Subsection 3.4.1) and hiding (see Subsection 3.4.2). The first proposition inserts randomness to the sensitive variables in order to uncorrelate the sensitive variable from the secret key, and thus, from the leakage traces. In addition, the hiding countermeasures propose to uncorrelate one leakage trace from another by inserting irrelevant information during the cryptographic process (e.g. encryption).

To circumvent these issues, some solutions have been introduced such as the high-order side- channel attacks (see Section 3.5) or the synchronization tools (see Subsection 3.4.2). But the efficiency of those solutions, and consequently the attack performance, highly depends on the Evaluator's expertise.

Hence, while some decision-making are eased by the attack scenario (e.g. simple vs. differential side-channel attacks, univariate vs. multivariate side-channel attacks, profiled vs. non-profiled side-channel attacks), others are very challenging to define (e.g. selection of points of interest, synchronization tools, the choice of the most effective combining functions) depending on the targeted cryptographic module and the implemented countermeasures. While the decisions provided on the latter challenges highly influence the efficiency of classical side-channel attacks, the Evaluator has to make a suited decision based on his own expertise or, in some worst case (e.g. selection of points of interest), following a rule of thumb. A solution suggests in automatically finding the setting that converges towards the optimal attack solution. As a natural consequence, investigating the benefits of the Deep Learning can be useful in order to reach this solution. This following chapter introduces this field and characterizes its beneficits from the Evaluator point of view.

WHAT'S NEXT?

Chapter 4

Deep Learning for Side-Channel Attacks

In this chapter, we describe the basic principles of Deep Learning that are applied throughout the rest of the manuscript. Hence, the first three sections are generic and not specific to the sidechannel context. This choice is motivated by the need of understanding all the concepts induced by the deep learning field. With this aim in mind, we begin this chapter with a definition of what a deep learning algorithm is and differentiate the supervised and the unsupervised problems. After presenting the different manners to approximate a function via the construction of neural networks, we describe how the training process is performed and define the challenges that occur when the Evaluator aims at approximating an unknown function. Finally, a specific DLSCA case study is proposed and an overview of the DLSCA literature is made. We conclude this chapter by presenting the datasets we consider in this thesis.

What is a Deep Learning Model?

Principles of Learning Algorithm

The goal of deep learning is to build algorithms which automatically learn how to solve a task that generally consists in processing the data for addressing a given problem. Definition 4.1.1.1 (Learning). [Mit97, p. 2] A computer program is said to learn from experience Exp with respect to some class of tasks and performance measure Perf, if its performance for solving tasks, as measured by Perf, improves with experience Exp.

Based on Definition 4.1.1.1, the Evaluator can follow the machine learning paradigm in order to automatically learn mathematical functions (also known as predictive model) that captures some properties of the leakage traces in order to make a decision, or return a prediction, related to the secret key manipulated by the cryptographic module. However, no universal approximator has been defined until now. Consequently, some assumptions have to be made before performing the learning phase. More precisely, a model space F (or hypothesis space), which defines a set of predictive models, has to be selected based on prior knowledge of the data (e.g. leakage traces). Typically, we say that a learning problem is realizable if the hypothesis space F contains the true unknown function which perfectly solves the given task. As classical algorithms, a learning algorithm is no more than a mathematical function F (.) that automatically learns to solve one or several tasks. In this manuscript, the task is characterized by the ability of the learning algorithm to automatically select F ∈ F that maps a leakage trace to the correct secret key k * .

To model such algorithm, the machine learning paradigm is based on the statistical learning theory, introduced by Vapnik and Chervonenkis [START_REF] Vapnik | On the uniform convergence of relative frequencies of events to their probabilities[END_REF]. This theory, detailed in Subsection 4.1.2, consists of studying the problem of inference by constructing a model from a set of data. In 2003, Bousquet et al. [START_REF] Bousquet | Introduction to Statistical Learning Theory[END_REF] describe it as a mathematical framework which can be roughly summarized in three steps. The transposition to the side-channel context can be presented as follows:

1. Collecting of a set T of leakage traces involved during a phenomenon we want to characterize (i.e. a cryptographic function, e.g. encryption, decryption), 2. Estimating of a model F ∈ F describing this phenomenon, 3. Making predictions using this model and verifying its suitability following the ground truth Y in order to retrieve information related to the secret key k * manipulated by the cryptographic module.

From a set of inputs, two phases are needed in order to consider the learning algorithm during an evaluation process. First, the profiling (or training) phase, consists in monitoring it to complete one or several tasks given a set of profiling inputs I p . From I p and the related predictions, a penalization term is computed in order to correct the decision-making of the learning algorithm and improve its performance for resolving tasks. Then, once the learning algorithm is trained, the inference phase uses the resulted F to make predictions against previously unseen and unlabeled set of data I a . This scenario is typically what the Evaluator does when he performs a profiled side-channel attack (see Subsection 3.3.3). Hence, the deep learning-based side-channel attacks can be filed in this category.

To consider such scenario, the Evaluator has to differentiate the multiple experiences exposed by the machine learning community. Typically, these experiences Exp can be categorized into two branches: supervised learning and unsupervised learning.

Supervised learning. This approach uses a set of inputs (i.e. leakage traces) to teach a model to yield a set of labels (i.e. Y). In this setting, we assume that the Evaluator has access to a set of N p labeled (or annotated) leakage traces which can be defined as

I p = {(t 0 , y 0 ), . . . , (t Np-1 , y Np-1 )} with (t i , y i ) 0≤i<Np ∈ (T × Y).
Mainly considered for resolving classification or regression tasks, the supervised learning approach builds a model which predicts a targeted sensitive variable Y from a leakage trace T. The term "supervised" refers the annotated data that the Evaluator uses to correct the decision-making of the learning algorithm by comparing the predicted output Ŷ with the real expected label Y .

In supervised learning, the learning algorithm is trained to produce a function F : T → P(Y) that takes a data as input and outputs a PMF over a finite domain Y. This learning process can be split into two tasks: regression task and classification task. The distinction between these approaches lies in the definition of Y. Typically, in regression tasks, the resulted model Unsupervised learning. This learning algorithm differs from the supervised learning as it handles with an unlabeled training set (i.e. I p = T = {t 0 , t 1 , . . . , t Np-1 }). Hence, contrary to the supervised learning approach which produces functions that map an input T to a class or a continuous value in Y, the unsupervised learning observes several inputs T and attempts to learn the entire probability distribution Pr [T] that generates a dataset. These learning algorithms automatically discover patterns or data groupings without the Evaluator's intervention. Based on similarity measures, it is highly beneficial to perform data analysis, clustering [START_REF] Lloyd | Least squares quantization in pcm[END_REF][START_REF] Comaniciu | Mean shift: a robust approach toward feature space analysis[END_REF] or dimensionality reduction [START_REF] Jolliffe | Principal Component Analysis[END_REF][START_REF] Van Der Maaten | Visualizing data using t-SNE[END_REF].

The classical profiled side-channel attacks usually approximate the conditional probability distribution Pr [T|Y ], thus, it can be assigned to a supervised learning experience as it requires to label each leakage trace T. Similarly, deep learning-based side-channel attacks consider the classification task Pr [Y |T] as suited to retrieve the secret key involved in the targeted cryptographic module. Hence the leakage traces need to be labeled in order to perform both approaches. However, some differentiation can be highlighted. These specifications will be deeper investigated in Part II. As previously mentioned, two phases have to be conducted for considering a model as operational. The first one, namely profiling phase, aims at reducing the error the model made from several leakage traces. While this process can differ between supervised and unsupervised approaches, the following section will be specifically oriented for resolving classical side-channel tasks (i.e. supervised problems).

The main idea of the following section is to introduce the concept of learning theory which describes the notion of true risk and empirical risk. These metrics are mandatory to explain how a model F is selected from a finite model space F.

Learning Theory

To train a learning algorithm in supervised setting, the Evaluator has to deal with a training set of labeled D-dimensional leakage traces, such that, the pairs (T, Y ) ∈ T × Y are independently and identically distributed (i. The most natural loss for classification is the 0 -1 loss which can be defined as follows:

L 0-1 (F (T), Y ) =    0 if arg max y∈Y F (T)[y] = Y, 1 otherwise.
This loss corresponds to the proportion of incorrectly predicted values Ŷ = arg max y∈Y

F (T)[y].
Thus, considering the 0 -1 loss function is beneficial to measure the error rate of the learning algorithm. Then, to completely assess the quality of the selected model F , the notion of true risk has to be clearly introduced. The smaller the true risk (also known as generalization error), the better the model F . Hence, the supervised learning aims at finding a model minimizing this criterion. However, this metric cannot be computed since the joint distribution Pr[T, Y ] is unknown. Thus, the task of learning algorithm is to minimize the true risk without being able to evaluate it directly. An alternative is to compute an empirical risk (also known as empirical error) from a labeled training set I p of finite size.

Definition 4.1.2.3 (Empirical risk). Given

I p = {(t 0 , y 0 ), . . . , (t Np-1 , y Np-1 )}, with (t i , y i ) 0≤i<Np ∈ T × Y, a labeled training set of size N p , a loss L : F × Y → R and a model F : T → P(Y), the empirical risk R(L, F ) defines the expected loss over I p : R(L, F ) = 1 N p Np-1 i=0 L (F (t i ), y i ) . (4.1)
The larger the size of the training set is, the closer to the true risk the empirical risk is. Indeed, following the law of large number theorem, we immediately obtain that:

Pr     R(L, F ) -lim Np→∞ 1 N p Np-1 i=0 L (F (t i ), y i )   = 0   = 1. (4.2)
This result indicates that with enough leakage traces, the Evaluator can compute an empirical risk which is a good approximation of the true unknown risk.

Minimizing this empirical risk is thus highly beneficial to generate a suited learning algorithm for completing a given task.

Empirical risk minimization.

The principle of Empirical Risk Minimization (ERM) is to pick a model F from a finite model space F that minimizes the empirical risk as follows:

F = arg min F Θ ∈F R(L, F Θ ). (4.3)

MAIN RESULT IN DL CONTEXT

Although the ERM rule seems very natural, this approach may miserably fail. Indeed, the next section discusses the situation where the true risk is much larger than its empirical risk. This behavior can be exposed through an error decomposition inducing a generalization gap.

Generalization Learning Boundary

For constructing a good model, we would like to learn an algorithm which minimizes the empirical risk as a surrogate of the true unknown risk R. More importantly, we expect to select a model F which performs similarly on unseen labeled leakage traces T drawn from Pr[T, Y ]. In statistical learning theory, this notion is often referred to as the generalization gap and it is denoted as |R(L, F )-R(L, F )| for a given loss L and a given model F included in a finite model space F. For the sake of simplicity, this subsection is focused on binary classification tasks (e.g. Y = {-1, 1}) but this notion can be extended to multi-classification tasks. When the Evaluator designs and trains a model, we can reasonably hope that the following probability condition holds:

Pr |R(L, F ) -R(L, F )| ≥ ≤ δ, (4.4)
with ≥ 0 and δ ∈ [0, 1]. Bounds of this form are generally derived from the probability approximately correct (PAC) learning framework and are usually independent of the unknown distribution Pr[T, Y ] from which leakage traces are drawn. This solution is useful in order to bound the gap between the true risk and the empirical risk given a model F . One common tool for deriving generalization bounds is the theory of uniform convergence of empirical quantities [START_REF] Vapnik | On the uniform convergence of relative frequencies of events to their probabilities[END_REF]. It means that, for any model F ∈ F, the true risk R is bounded by its empirical risk R and a penalty term depending on the number of training leakage traces N p , the size (also known as complexity) of F and the probability δ.

R(L, F ) ≤ R(L, F ) + log |F| + log 1 δ 2 • N p , (4.5)
with probability 1 -δ.

Theorem 4.1.3.1 highlights the impact of some variables in the generalization gap. First, as illustrated in Equation 4.2, increasing the size of the labeled training set is beneficial to converge the empirical risk towards the true risk by the law of large number property. However, the model complexity (i.e. |F|) can badly influence the generalization gap. Intuitively, the larger the value |F| is, the more models F ∈ F exist that will fit the training data to resolve the underlying problem (i.e. classification task). However, considering too complex model class can also be harmful for the generalization gap. Even if Theorem 4.1.3.1 is valuable for finite model space F, this notion has to be extended to continuous cases. In [START_REF] Vapnik | On the uniform convergence of relative frequencies of events to their probabilities[END_REF], the Vapnik-Chervonenkis dimension of a model space F, denoted V C(F), has been defined as the cardinality of the largest dataset that can be shattered by F. If arbitrarily large finite sets of leakage traces T can be shattered by F, then V C(F) = ∞. Hence, using the VC-dimension is helpful to extend the bound defined in Equation 4.5.

Theorem 4.1.3.2 (Uniform convergence bound with VC-dimension). [START_REF] Bousquet | Introduction to Statistical Learning Theory[END_REF] Let F be a continuous model space with VC-dimension V C(F), I p be a labeled training set of size N p i.i.d from an unknown probability distribution Pr[T, Y ] and δ > 0. For any F ∈ F, a generalization bound states that we have:

R(L, F ) ≤ R(L, F ) + 2 • 2 • V C(F) log 2•Np•e 1 V C(F ) + 1 -log δ 2 N p , (4.6)
with probability 1 -δ.

The bound defined in Equation 4.6 is in accordance with the previous observation. Indeed, the general idea is that the model space must be complex enough to achieve a low empirical risk R, but not too complex in order to limit the rise of V C(F) (or |F| for finite case) which leads to high bounds on the true risk R. This phenomenon can be observed in Figure 4.1. More precisely, three phases can be observed.

Remark 4.1.3.1. As highlighted throughout this section, the theoretical frameworks used to bound the generalization gap assume, on the one hand, that the data instances tend to the true unknown joint distribution Pr[T, Y ] if the amount of data tends to infinity and, on the other hand, that the complexity of the task does not influence the gap between the true risk and the empirical risk. While the first assumption cannot be validated in practice as the Evaluator does not capture an infinite number of leakage traces, the latter issue may fail to describe certain tasks. For instance, in deep learning, the resulted models are often over-parametrized and the complexitybased boundaries failed to describe the generalization capabilities of such deep neural networks [ZBH + 17, NLB + 19, ZBH + 21]. As this research direction remains open, we consider it as out of the scope of this thesis. Consequently, the rest of the manuscript follows the classical generalization bounds defined in the machine learning literature.

While the Evaluator's goal is to construct a learning algorithm such that the empirical risk is as close as possible to the true unknown risk (see Equation 4.3), he has to find a good tradeoff between model complexity and the upper bound on the true risk in order to generalize its knowledge on unseen datasets. If the model complexity is low, the penalty term can be almost negligible (see Equation 4.5 and Equation 4.6) while the empirical risk is high because of the poor representativity of F which is caused by the low dimensionality of F. Hence, the models included in F can be not complex enough to fit with its input. For example, considering only linear functions in F is not suitable if the task that has to be resolved is a polynomial function. This issue is called underfitting and it occurs when the model complexity is not able to obtain a sufficiently low empirical risk in comparison with the true risk. On the other hand, if the model complexity increases, the difference between the empirical risk and the true risk decreases unlike the penalty term. Unfortunately, this situation, called overfitting, leads to an increase of the generalization gap such that the true risk is much larger than the empirical risk. In other words, the resulted model learns by "heart" the labeled training sample but has poor performance on unseen samples drawing from the same unknown distribution Pr[T, Y ]. Hence, the Evaluator has to find a good tradeoff between the minimization of the empirical risk and the ability of the related model to generalize its knowledge on unseen data. However, even if the model space complexity is too large, the Evaluator can mitigate it through a penalization process that will be introduced in the following section.

Regularization

If the Evaluator chooses its model based on the empirical risk minimization, he can encounter overfitting issues when the model complexity is large. In order to reduce this problem, he can consider the principle of Regularized Empirical Risk Minimization (RERM) which consists in picking a model F from a complex space F and a parameter λ that minimizes the empirical risk as follows:

F = arg min F Θ ∈F R(L, F Θ ) + λ • C(F Θ ) , (4.7)
with C(.), called regularizer, is a model complexity measure. A common practice is to select the p-norm ||.|| p on the parameters of the model F Θ , i.e. Θ, as regularizer. The free parameter λ ≥ 0, called the regularization parameter, allows choosing the right tradeoff between generalization and model complexity. The role of the RERM is to consider the model complexity in the selection process of a model in order to reduce the overfitting issue. Typically, the choice of regularizer is important and depends on the considered task and the desired effect. Let us assume that the Evaluator wants to generate a model The optimal RERM solution is defined by Θ * but can lead to overfitting issues.

F ∈ R 2 such that (a) L 1 -norm (b) L 2 -norm
||F || p is bounded by a constant α. Thus, F characterizes all the model defined by 2 parameters, denoted θ 0 and θ 1 (i.e. Θ = [θ 0 , θ 1 ]), at most such that the RERM principle aims at finding the one minimizing Equation 4.7. Figure 4.3 plots the most common norm-based regularizers considered by the deep-learning community, namely the L 1 -norm and the L 2 -norm. To satisfy Equation 4.7, we have to reach an equilibrium configuration Θ (= [ θ0 , θ1 ]) between the regularizer and the empirical risk. This point is illustrated by a purple circle in Figure 4.3. As we can observe, depending on the regularizer we consider, we do not regularize the empirical risk in the same way. While the L 1 regularizer tends to cut off some parameters by turning their coefficients to zero, the L 2 regularizer tends to shrink these coefficients to a tiny value, while avoiding too large parameters, in order to keep some of their influence on the prediction. This observation can be made in Figure 4.3. Indeed, through Figure 4.3a, the Evaluator forces to choose a model F ∈ F such that the following equilibrium point (0, θ1 ) is reached. Hence, considering the L 1 regularizer aims at reducing the complexity of the selected model F by shrinking a parameter to 0. On the other hand, Figure 4.3b slightly differs from L 1 regularizer by choosing a model F ∈ F with a non-zero (but relatively small) parameter θ0 .

To adequately select the most suited predictive model F from F, the Evaluator has to choose the one respecting the following conditions:

1. Minimize the empirical risk defined in Equation 4.3, 2. Generalize its behaviour on unseen data. In such purpose, the generalization gap |R(L, F ) -R(L, F )| has to be minimized.

3. Reduce the underfitting and overfitting issues by adequately configuring the finite model space F. Thus, F should be complex enough to solve the related task (i.e. extracting sensitive variable from a leakage trace). However, if the model space is too complex, the Evaluator can consider some regularization tools in order to reduce the overfitting issue.

SUM UP. . .

While the regularization process is suitable to mitigate the model complexity, the Evaluator has to define the space F which can be characterized through different approaches (e.g. kernel support vector machines [START_REF] Boser | A training algorithm for optimal margin classifiers[END_REF][START_REF] Cortes | Support-vector networks[END_REF], decision tree classifiers [START_REF] Breiman | Classification and Regression Trees[END_REF], etc). The following section extends the notion of model estimation through the application of neural networks.

Model Estimation through Neural Networks

Function Approximation Tools

So far we have introduced the Learning Theory principle as a tool selecting a model F from a generic model space F. As mentioned in Subsection 4.1.1, the aim of supervised deep learning approach is to select a model F : T → P(Y) from F which takes a D-dimensional leakage trace T ∈ R D as input and outputs a PMF a over a finite domain Y. One solution to construct the related learning algorithm is to design parametric functions such that the parameters that minimize Equation 4.1 are automatically learned. A parametric model F Θ defines a set of functions indexed by a vector Θ of scalar called weights. A simple example is a set of linear functions F Θ : R → R defined by:

F Θ (T) = θ 0 + θ 1 • T, with Θ = [θ 0 , θ 1 ] ∈ R 2
such that θ 0 is also known as the bias. A graphical representation of such linear function is illustrated in Figure 4.4a. This figure is a typical example of a feedforward neural network structure. The first feedforward neural network, namely perceptron, was developed in 1958 [START_REF] Rosenblatt | The perceptron: A probabilistic model for information storage and organization in the brain[END_REF] and can be expressed as the following parametric model

F Θ (T) = Θ [1:D] , T + Θ[0]
where , called activation function, is a non-linear function and Θ ∈ R D+1 . In [START_REF] Rosenblatt | The perceptron: A probabilistic model for information storage and organization in the brain[END_REF], it is characterized by a threshold activation function which outputs 1 if, for a threshold τ ∈ R,

Θ [1:D] , T + Θ[0] > τ .
Since then, many activation functions have been explored by the machine learning community [MHN13, CUH16, HG16]. Given a vector Θ ∈ R D+1 and a vector v ∈ R D , this thesis will only consider the following ones:

• ReLU -the rectified linear unit activation function outputs a vector of non-negative value respecting the following equation:

relu

Θ [1:D] , v + Θ[0] = max 0, Θ [1:D] , v + Θ[0] .
• SELU -the scaled exponential linear unit activation function [START_REF] Klambauer | Selfnormalizing neural networks[END_REF] is an alternative to the ReLU and recommended for its self-normalizing properties. The SELU is defined as follows:

selu

Θ [1:D] , v + Θ[0] = λ Θ [1:D] , v + Θ[0] if Θ [1:D] , v + Θ[0] > 0, α(exp( Θ [1:D] , v + Θ[0]) -1) if Θ [1:D] , v + Θ[0] 0.
(4.8) The SELU function pushes neurons towards zero mean and unit variance in order to prevent vanishing and exploding gradient problems discussed in Subsection 4.3.2.

• Softmax/Sigmoid -this activation function normalizes a vector into a probability distribution over |Y| different possible outputs. It can be computed as follows:

sof tmax Θ [1:D] , v + Θ[0] = e Θ [1:D] ,v +Θ[0] [j] z e Θ [1:D] ,v +Θ[0] [z] , for j ∈ [0, |Y| -1] .
The softmax is a generalization of the sigmoid activation function applied to multiple classes.

The sigmoid function, considered to deal with binary classification problems, is characterized as follows:

sigmoid

Θ [1:D] , v + Θ[0] = 1 1 + e -Θ [1:D] ,v +Θ[0] .
a This notion is defined in Section 2.4. Even if a perceptron is useful for constructing a parametric model, it considers low model space complexity F because it can only generate models classifying linearly separable sets of vectors. While the approximation of linear functions can be suited in many scenarios, the Evaluator can suggest the construction of a more complex parametric learning model in order to reduce the gap between the true risk R and the empirical risk R. The Evaluator can then combine multiple perceptrons in order to construct a neural network which can be represented as a directed acyclic graph such that the weight values are characterized by the edges.

Example 4.2.1.1 (The XOR function.). To illustrate the directed acyclic graph idea, we construct a parametric model approximating the XOR function. As defined in Section 2.2, the XOR function is an operation on two binary values t 0 and t 1 such that it returns 1 if and only if exactly one of these bits equals 1. It returns 0 otherwise. In other words, the XOR operation between two bits can be defined as follows:

t 0 ⊕ t 1 = (t 0 ∨ t 1 ) ∧ (t 0 ∧ t 1 ).
Hence, this function is non-linearly separable by a single decision boundary line: a perceptron cannot generate a suitable parametric model. Indeed, a XOR function can be decomposed into three operations which are non-linearly separable, namely an OR and a NAND which are aggregated into a AND gate. Hence, the resulted directed acyclic graph can be decomposed into three nodes (also called neurons) such that each of them is modeled by a perceptron. In this example, OR and NAND operations are independent and thus, can be simultaneously approximated such that the weight vector Θ

[1] 1 (resp. Θ [1]
2 ) expresses the importance of the bits t 0 and t 1 to perform the OR (resp. NAND) operation. More precisely, the OR neuron outputs 1 if, at least, one of its inputs equals 1 while the NAND neuron returns 1 if and only if neither input is not activated at the same time. To express the independence between these nodes, the neurons are gathered under the same layer. Typically, three types of layers can be defined: the input layer receives the input of the parametric model while the last layer, denoted output layer, is mostly responsible for the decision-making related to the prediction ŷ. All the layers in between are called hidden layers. Hence, once the OR and NAND are processed in the hidden layer, the related results are put in the last neuron which computes the AND operation (see Figure 4.4b). Depending on the output of the last layer, the Evaluator makes a decision on the estimated ŷ characterizing the XOR operation between t 0 and t 1 . In addition, while the combination of linear functions is also linear, each neuron has to consider a non-linear activation function (e.g. ReLU, SELU, etc) in order to correctly approximate the XOR function.

As illustrated, a neural network is no more than a parametric function F Θ that aims at resolving a given task in Y. However, the Evaluator can question how well an arbitrary neural network approximates his underlying problem.

Universal Approximation Theorem.

In [START_REF] Cybenko | Approximation by superpositions of a sigmoidal function[END_REF], Cybenko proves that a particular neural network, namely fully-connected neural network (FCNN), considering one hidden layer and a finite number of neurons can approximate any bounded and regular function if is sigmoidal (i.e. sigmoid ). This result was extended to a wide range of non-polynomial activation functions [START_REF] Hornik | Approximation capabilities of multilayer feedforward networks[END_REF][START_REF] Pinkus | Approximation theory of the mlp model in neural networks[END_REF] but does not ensure that all activation functions perform equally well in specific problems. More formally, the FCNNs respect the universal approximation theorem which can be stated as follows.

two vectors v = [v 0 , . . . , v N -1 ], b = [b 0 , . . . , b N -1 ] ∈ R N and a matrix Θ ∈ M D,N (R
) such that we may define:

F Θ (T) = N -1 i=0 v i ( Θ i , T + b i ) , as an approximation of any function f ∈ C(I D ), |F Θ (T) -f (T)| < .
The Universal Approximation Theorem is interesting from a theoretical point of view because it suggests that a neural network with a single hidden layer can be sufficient to approximate a wide range of functions. However, from a practical perspective, the number of neurons in the hidden layer can exponentially grow, inter alia, with the generalization gap introduced in Subsection 4.1.3.

IN SHORT . . .

Fortunately, some alternative solutions can be considered in order to reduce the number of weights induced in a neural network. Indeed, in [START_REF] Eldan | The power of depth for feedforward neural networks[END_REF], Eldan and Shamir reduce the limitations brought by the universal approximation theorem by suggesting that neural networks with 3 layers can be designed to approximate some functions which cannot be estimated with shallow and wide neural networks. In addition, they show that even if the depth is increased by 1, it can be exponentially more valuable than width. This suggestion was confirmed in [START_REF] Telgarsky | Benefits of depth in neural networks[END_REF] for any positive number of layers.

While this section introduces the concept of parametric model, the following one proposes to extend this notion to particular neural networks, namely fully-connected neural networks (FCNNs) and convolutional neural networks (CNNs).

Neural Network Architectures

To approximate a complex parametric model F Θ , the Evaluator can extend the notion we briefly introduced in Subsection 4.2.1, namely neural network. More formally, a neural network can be defined as follows.

Definition 4.2.2.1 (Neural Network). Given a D-dimensional input T, a neural network characterizes a parametric model F Θ : R D → R |Y| which can be defined as the following composition:

F Θ (T) = [L] • g [L] Θ [L] • [L-1] • . . . • [2] • g [2] Θ [2] • [1] • g [1] Θ [1] • T,
where L defines the number of layers that forms the neural network, [l]

: R N [l] → R N [l]
is a non-linear activation function related to the l th layer which includes N [l] neurons, g

[l] Θ [l] : R N [l-1] +1 → R N [l]
denotes the operation induced in the l th layer and involving a matrix Θ [l] = {Θ

[l] 0 , . . . , Θ [l] N [l-1] +1 } ∈ M N [l-1] +1,N [l] (R).
Definition 4.2.2.2 (Network Architecture). The network architecture is defined by the shape of the related neural network. Definition 4.2.2.3 (Network Complexity). The network complexity denotes the number of weights that constitutes the related parametric model F Θ .

One classical example of neural networks is the multilayer perceptrons and refers to neural networks composed by multiple layers of numerous neurons considering as a threshold activation function (i.e. perceptron). An extension of the multilayer perceptrons is the fully-connected neural network that defines a neural network such that all the neurons induced in one layer are connected to the neurons in the next layer. In other words, Definition 4.2.2.1 substitutes g

[l] Θ [l] with the dot product between a matrix Θ [l] ∈ M N [l-1] +1,N [l] (R) and a vector v in R N [l-1] +1 , denoted Θ [l] , v .
An example of fully-connected neural network applied in side-channel context is provided in Figure 4.5a. The structure agnostic property of this architecture is one of its main advantages. Indeed, to consider it, no particular assumption has to be made on the data structure (e.g. image, video, leakage trace, etc). In side-channel context, this is beneficial to automatically learns the time samples that have to be combined in order to recover the secret key manipulated by the targeted cryptographic module. However, from a practical point of view, the fully-connected neural networks can be difficult to consider due to their extremely high complexity. Thus, following Subsection 4.1.3, this type of neural network can lead to overfitting issues such that the upper bound of the true risk R increases with its complexity. To circumvent this issue, a solution consists of only combining nearby neurons instead of all of them. In such configuration, the network complexity can be drastically reduced while preserving variables that are temporally and spatially highly correlated. A neural network respecting this restriction, called convolutional neural network, has been proposed by LeCun et al. in 1989 [LBD + 89]. While this manuscript is mainly focused on this neural network structure, a detailed description of the convolutional neural network is proposed.

Convolutional Neural Network.

In this manuscript, we choose to simplify its representation by considering that it can be decomposed into two parts: a feature selection part, which extracts information from a leakage trace T to help the decision-making (i.e. points of interest) b , and a classification part which combines these relevant features in order to correctly retrieve the targeted secret key k * (see Figure 4.5b). To select features, a CNN is composed of n 3 stacked convolutional blocks that correspond to n 2 convolutional layers (denoted γ), combined with an activation function , and one pooling layer (denoted δ) [START_REF] Keiron | An introduction to convolutional neural networks[END_REF]. One interesting property of the convolutional block is to combine three central ideas, namely locality, shared weights and temporal subsampling [START_REF] Lecun | Gradient-based learning applied to document recognition[END_REF]. This is strongly beneficial to reduce the problem of performance loss caused by distortion techniques as those introduced in Subsection 3.4.2. This motivates Cagli et al. [START_REF] Cagli | Convolutional neural networks with data augmentation against jitter-based countermeasures -profiling attacks without pre-processing[END_REF] to investigate the suitability of such neural network in side-channel context in order to reduce the hiding countermeasures. Then, the feature recognition part is plugged into the classification part of n 1 Fully-Connected layers (denoted λ) that are similar to those used in fully-connected neural networks. Finally, a predicting layer, denoted λ |Y| , composed of |Y| classes is considered in order to compute Pr[Y |T] which is mandatory to perform the log-likelihood distinguisher (see Definition 3.3.3.4). This conditional probability is measured via the softmax activation function sof tmax . To sum up, a common convolutional network can be characterized by the following formula:

sof tmax • λ |Y| • [ • λ] n1 • [δ • [ • γ] n2 ] n3 .
b This assumption is verified in Chapter 6. Convolutional layer (γ). The convolutional layer performs a series of convolutional operations on a leakage trace T, used as input, to facilitate the identification of patterns containing a non-negligible deterministic part ψ(Y ). In that purpose, each leakage trace T is convolved with a filter (also called kernel). The output of the convolution reveals temporal instants that influence the classification. These time samples are called features. To build a convolutional layer identifying suitable features, some parameters have to be configured by the Evaluator, namely length of filters, number of filters, stride and padding.

• Filters -They are designed to identify features that increase the efficiency of the classification task, i.e. retrieving k * . However, depending on their size, filters reveal local or global features. Smaller filters tend to identify local features while larger filters focus on global features. Figure 4.6 gives an example in which the length of filters is set to 3.

• Stride -Stride refers to the step between two consecutive convolutional operations. Using a small stride corresponds to the generation of an overlap between different filters while a longer stride reduces the output dimension. By default, the stride is set to 1 (see Figure 4.6).

• Padding -Let a and b be two vectors such that dim(a) = dim(b), the dimension of the convolution between these two vectors will be dim(a b) = dim(a)-dim(b) stride + 1 where refers to the convolution operator. In some cases, a subsample may be generated. To avoid this phenomenon and losing information, a padding can be used in order to add a "border" on the related leakage trace T. This processing ensures that the input dimension is retained after the convolutional operation. By default, two kinds of padding are used: valid padding and same padding. Valid padding means "no-padding" while same padding refers to a zeropadding (the output has the same dimension as the input). Figure 4 in which same padding is selected. Indeed, two 0 values are added at the endpoints of the vector in order to obtain an output vector of dimension 6.

After each convolutional operation, an activation function is performed in order to only keep the features identified as relevant for the classification.

Pooling layer (δ). The pooling layer is a non-linear layer that divides the dimension of the leakage traces such that the most relevant information is preserved. To apply its down sampling function, a pooling window and a pooling stride have to be configured. Usually, these variables have the same value to avoid overlapping. The window slides through the leakage trace in order to select a segment where the pooling function can be applied. In deep learning, two pooling functions are commonly used:

• MaxPooling -The output of the pooling operation is defined as the maximum value contained in the pooling window.

• AveragePooling -The output of the pooling operation is defined as the average of the values contained in the pooling window.

M =          t 0 [0] t 0 [1] t 0 [2] • • • t 0 [d -1] t 1 [0] . . . • • • • • • . . . t 2 [0] • • • . . . • • • . . . . . . . . . . . . . . . . . . t n-1 [0] • • • • • • • • • t n-1 [d -1]          (4.9)
where (t i ) 0 i<n is the i th intermediate trace, which is defined by the i th output of the last convolutional block, and (t i [j]) 0 j<d the j th sample of the i th trace. The output of the flatten layer is a concatenated vector C that can be constructed following two approaches:

• Column-wise -C = [t 0 [0], t 1 [0], t 2 [0], ......., t n-1 [d -1]], • Row-wise -C = [t 0 [0], t 0 [1], t 0 [2], ......., t n-1 [d -1]].
Fully-connected layers (λ). Once the convolutional part has selected the relevant features, one or several fully-connected layers are set in order to recombine each neuron and accurately classify each leakage trace T provided as input of the convolutional neural network. Fully-connected layers can be compared to a fully-connected neural network where each neuron has full connections to all activation functions of the previous layer (see Figure 4.5). Once the Evaluator designs a neural network that characterizes a parametric model F Θ , he has to determine the value of the weights, included in Θ, such that F Θ is able to retrieve the secret key manipulated by the targeted cryptographic module. To find this solution, he has to perform a so-called training process that is based on an optimization problem we describe in the following section.

Predicting Layer

A Step Towards the Optimal Parametric Model

Optimization Problem

Recall that the goal of a learning algorithm is to find a model F ∈ F which minimizes the empirical risk R (see Definition 4.1.2.3) such that F = arg min

F Θ ∈F
R(L, F Θ ) and respecting a tight generalization gap with the true risk R. Hence, given a parametric model F Θ and a loss function L, the Evaluator has to find the weights Θ that minimizes the empirical risk as suggested in Equation 4.3. This requirement can be provided by some optimization tools such as the gradient descent.

Gradient Descent [C + 47]. Gradient descent is an iterative minimization algorithm which consists in computing the gradient of the empirical risk in order to monitor the trainable parameters such that R is minimized. Given a parametric model F Θ and a differentiable loss function L, the Evaluator has to compute the vector of partial derivatives of R at the weights of the l th layer (i.e. Θ [l] ), denoted ∇ Θ [l] R(L, F Θ ) (see Equation 2.1). These partial derivatives give the direction in which the empirical risk R has the steepest ascent. Taking the opposite direction is helpful to find the weight values minimizing the loss function such that, from a random starting point Θ

[l] (0) , the weights are updated as follows at each iteration:

Θ [l] (i+1) = Θ [l] (i) -η • ∇ Θ [l] (i) R(L, F Θ (i) ), (4.10)
where Θ

[l]

(i) denotes the value of the trainable parameters at the i th iteration and η > 0, called learning rate, is a parameter that the Evaluator has to configure. More precisely, it quantifies the size of the step to reach a minimum. After n iterations, the Evaluator can update the weight values following multiple strategies: averaging the weight values Θ

[l] = 1 n n i=1 Θ [l] (i) ,
F Θ (i) .
If R(L, F Θ ) is a convex-Lipschitz function, the number of iterations, needed for reaching the unique optimal solution Θ * which minimizes R(L, F Θ ), such that R(L,

F Θ ) -R(L, F Θ * ) ≤ is achieved, growths with 1 2 [SSBD14, Corollary 14.2].
Hence, the number of iterations can be large as decreases. In addition, while the classical gradient descent algorithm considers the entire training set I p to update the weight values Θ, each iteration can be expensive from a computational point of view. Hence, some alternative solutions have to be considered.

One common solution to perform such gradient descent optimization is to apply the Stochastic Gradient Descent (SGD) algorithm which approximates the most suitable parametric model F Θ on a single leakage trace (t j ) 0≤j<Np instead of I p . Hence, from a random starting point Θ

[l] (0) , the weight values are monitored as follows:

Θ [l] (i+1) = Θ [l] (i) -η • ∇ Θ [l] (i) R(L, F Θ (i) (t j )[y j ]).
This equation is repeated over the entire set I p until R(L, F Θ ) converges. While only one random leakage trace is processed at a time, the SGD is beneficial from a computational perspective. In addition, for large datasets, the resulted parametric model can converge faster towards the minima of the loss function because the parameters are updated more frequently. From an optimization point of view, the SGD has some limitations. Indeed, due to the multiple iterations performed on a single leakage trace, a high variance can be observed from an iteration to another. This phenomenon leads to unstable convergence to the loss minima. One solution to reduce this issue is to compute the stochastic gradient descent over mini-batch that characterizes a set of few training leakage traces included in I p . This gradient descent algorithm, called Mini-Batch Gradient Descent, is useful to reduce the variance of the parameter updates and leads to stable convergence. To compute the gradient over Θ, the Evaluator has to consider the backward propagation described below.

Backward propagation. This algorithm, also called

∈ R m , b ∈ R n . Let g be a function which maps from R m to R n such that b = g(a). Let f maps an input from R n to R such that f (b) = f • g(a)
. Then, by the chaining rule, the partial derivative of f (g(a)) at a can be decomposed as:

∇ a f (g(a)) = J g (a) T • ∇ g(a) f (g(a)), (4.11)
where J g (a) is the Jacobian matrix of g at a (see Equation 2.2).

From this definition, we see that this principle can be used to compute the partial derivative of parametric models as those introduced in Definition 4.2.2.1. The backpropagation algorithm has been proposed to iteratively compute the partial derivatives on each vector composing

Θ [i] = {Θ [i] 0 , . . . , Θ [i] N [i-1] +1 } ∈ M N [i-1] +1,N [i] (R)
in order to reduce the storage issue of Jacobian matrix.

Even if Definition 4.3.1.1 is focused on vectors, the chain rule can be applied on tensors of arbitrary dimensionality. Indeed, as mentioned in Definition 4.2.2.1, neural networks deal with matrices. Hence, to extend the chain rule principle to any arbitrary dimension, the Evaluator has to flatten the related matrix into a vector before its application. Once the gradient is computed following Equation 4.11, the result can be reshaped in order to fit with the related neural network.

COMPUTATIONAL TRICK

Consequently, given a parametric neural network F Θ (see Definition 4.2.2.1), the backpropagation algorithm follows Definition 4.3.1.1 in order to facilitate the computation of partial derivative

∇ Θ [l] R(L, F Θ ) at a given layer indexed at l. Indeed, if a = T, g(a) = F Θ = [L] • g [L] Θ [L] • . . . • [1] • g [1] Θ [1] • T and f • g(a) = R(L, F Θ )
, then, we can rewrite Equation 4.11 as follows:

∇ Θ [l] R(L, F Θ ) = N [l] j=0 J ( [L] •g [L] Θ [L] •...• [l] •g [l] Θ [l] )[j] Θ [l] T • ∇ ( [L] •g [L] Θ [L] •...• [l] •g [l] Θ [l] )[j] R(L, F Θ ).
In other words, the backpropagation algorithm computes the gradient of R(L, F Θ ) with respect to the trainable parameters induced in the layer indexed at l (i.e. Θ [l] ). While the neural network F Θ is a composition of functions, the chain rule can be performed to iteratively determine (

∇ [L] •g [L] Θ [L] •...• [l] •g [l] Θ [l] R(L, F Θ )) 1≤l≤L .
The term backpropagation can be explained by the

need of computing ∇ [L] •g [L] Θ [L] •...• [l+1] •g [l+1] Θ [l+1] R(L, F Θ ) before ∇ [L] •g [L] Θ [L] •...• [l] •g [l] Θ [l]
R(L, F Θ ) because some terms needed for defining the gradient of R(L, F Θ ) at g

[l+1] Θ [l+1] are mandatory to compute ∇ ( [L] •g [L] Θ [L] •...• [l] •g [l] Θ [l] ) R(L, F Θ ).
The interested reader may refer to [GBC16, Section 6.5.6] for additional information on the backpropagation algorithm.

Remark 4.3.1.1. To accelerate the learning phase, LeCun et al. [START_REF] Lecun | Efficient BackProp[END_REF] suggest to preprocessed each dataset such that the leakage traces are standardized (unit variance) and normalized. The rest of this manuscript always considers this preprocessing phase before the beginning of the training phase.

However, given such optimizing algorithm, the Evaluator can question the ability of a learning algorithm to automatically find the optimal trainable parameters Θ * . The following section underlines the challenges induced by the optimization algorithms.

Optimization Challenges

Optimization can be considered as an arduous task. As defined in Subsection 4.3.1, the application of the gradient descent algorithm requires the consideration of differentiable loss functions. As suggested in Subsection 4.1.2, the 0 -1 loss can be expressed as a suited solution for resolving a classification task. However, while this loss function has a non-negligible issue of null derivative, the use of gradient descent algorithm is useless in such configuration. Consequently, the Evaluator has to optimize alternative loss functions, namely surrogate loss functions, which act as an approximation of the 0 -1 loss function.

Surrogate Loss functions.

A classical alternative to the 0 -1 loss function is the crossentropy measure. Definition 4.3.2.1 (Cross-Entropy). Given Pr[Y, T] denoting the joint distribution of a leakage trace T and the related targeted variable Y , the cross-entropy is defined as:

H(Y, T) = -E Y,T [log 2 (Pr [Y, T])] .
However, as mentioned in Subsection 3.3.3, Y is assumed to be uniformly distributed. Hence, following Equation 3.4, the cross-entropy can be simplified as follows:

H(Y, T) = -E Y,T [log 2 (Pr [Y |T])] .
Unfortunately, the computation of the cross-entropy needs to know the joint distribution Pr[Y, T] which is impossible for the Evaluator. A solution consists in applying the law of large number in order to approximate the cross entropy. The related loss function, called negative log-likelihood (NLL), can be associated with the empirical risk in order to solve this issue. Definition 4.3.2.2 (Empirical risk combined with negative log-likelihood). Given a set of N p labeled leakage traces I p = {(t 0 , y 0 ), (t 1 , y 1 ), . . . , (t Np-1 , y Np-1 )}, and a parametric model F Θ estimating the conditional probability distribution of observing a sensitive cryptographic primitive Y following a leakage T denoted as Pr [Y |T], the empirical risk combined with the negative loglikelihood loss function can be expressed as:

R(L N LL , F Θ ) = - 1 N p Np-1 i=0 log 2 F Θ (t i )[y i ].
While the optimal distinguisher (see Definition 3.3.1.4) considers the maximum log-likelihood as the statistical tool, this loss seems a natural choice for generating a suited parametric model

F Θ .
-Θ|| < , R(L, F Θ ) ≤ R(L, F Θ ).
In the context of gradient descent optimization, the stationary points that are neither local or global minimum are known as saddle points. While neural networks, induced in the empirical risk R, lead to generate non-convex functions, the gradient descent algorithm can typically converge towards a local minimum. This situation can be problematic if this point has a high empirical risk in comparison with the optimal solution (i.e. global minimum). In Figure 4.7, we provide an example of application of the gradient descent algorithm given a parametric model F Θ , such that Θ = [θ 0 , θ 1 ], a loss function L and the related empirical risk R(L, F Θ ). Depending on the random initialization Θ (0) , we observe that the gradient descent does not converge towards the same minimum. Indeed, in Figure 4.7a, the gradient descent converges towards a global minimum while its application in Figure 4.7b does not. In this example, we observe that R(L, F Θ * ) and R(L, F Θ ) do not provide a similar empirical risk value. So, to obtain the most efficient parametric model F Θ , the Evaluator expects the gradient descent algorithm to converge towards the global minimum. But finding this solution cannot be ensured. However, promising works suggest that even if the local minima with high empirical risk can be considered as an optimization issue, increasing the complexity of the parametric model F Θ can be useful to exponentially reduce this risk [DPG + 14, GVS15, AZLS19]. Another solution consists in considering the stochastic gradient descent instead of the gradient descent itself. As mentioned in Subsection 4.3.1, the SGD can be computed for reducing the computation cost. In addition, the application of this optimization algorithm on non-convex function converges in the sense of getting to points where the gradient is arbitrarily small [START_REF] Bertsekas | Gradient convergence in gradient methods with errors[END_REF]. However, this result does not mean that the solution converges towards a global or a local minimum. Even if an adequate small learning rate suggests an almost surely convergence towards a local minimum [START_REF] Lee | Gradient descent only converges to minimizers[END_REF] with a random initialization of the trainable parameters Θ, the SGD is not widely used in practice because the convergence can be extremely time-consuming. However, this problem remains an active research area and no general statements can be formally provided.

Depending on the slope of the derivative ∇ Θ [l] R(L, F Θ ), the convergence of the gradient descent algorithm can be highly impacted and finding a local minimum can be an arduous task. This issue, known as the vanishing & exploding gradient problem is detailed below.

Vanishing & exploding gradient. When the Evaluator trains a parametric model F Θ through the gradient descent algorithm, he updates its trainable parameters (i.e. Θ) in order to minimize the empirical risk R(L, F Θ ). In such purpose, he has to compute

∇ Θ [l] R(L, F Θ )
such that the weights get updated proportionally to the gradient (see Equation 4.10). Hence, a very small the gradient, known as vanishing gradient problem, does not effectively update the trainable parameters from a previous iteration. In the worst-case scenario, Θ stays stable such that the optimization process does not improve the related parametric model F Θ . Due to the chain rule principle used to perform the backpropagation algorithm, this issue grows with the depth of a neural network. This phenomenon leads to converge towards poor local minima or saddle points. While a vanishingly small gradient impacts the optimization of a parametric model, a large gradient does not necessarily improve it and can result in unstable gradients leading to a poor learning. While the goal of the gradient descent algorithm is to converge towards the global minimum, this issue, known as exploding gradient problem, can lead to a divergence of the optimization algorithm.

One solution to reduce both impacts is to adequately monitor the learning rate introduced in Equation 4.10. While a vanishing gradient problem induces a high learning rate in order to "get out" from a local minimum or a saddle point, a exploding gradient problem reduces the learning rate value for converging towards a suited point. The learning rate is defined as an optimizer hyperparameters that is defined as follows.

Definition 4.3.2.5 (Optimizer hyperparameters). The optimizer hyperparameters refer to parametric variables whose values are defined by the Evaluator in order to configure the training and the optimization processes.

Correlated with the ability of the gradient descent algorithm to converge towards a suited local minimum, the learning rate is considered as one of the most difficult optimizer hyperparameter to configure [GBC16, Section 8.5]. To reduce this issue, other optimizing algorithms with adaptive learning rates have been proposed in the literature: Adagrad [START_REF] Duchi | Adaptive subgradient methods for online learning and stochastic optimization[END_REF], RMSProp [START_REF] Tieleman | Lecture 6.5-RmsProp: Divide the gradient by a running average of its recent magnitude[END_REF], Adadelta [START_REF] Zeiler | Adadelta: An adaptive learning rate method[END_REF], Adam [START_REF] Kingma | Adam: A method for stochastic optimization[END_REF], etc. In this manuscript, we particularly choose the adaptive moment estimation (Adam) as optimizer. The reasons that motivate us can be enumerated as follows. First, to limit the negative impact of unstable gradients at the i th iteration, it computes an exponentially decaying moving average of the previous gradients. This solution demonstrates a high benefit to converge faster towards the solution [START_REF] Ning Qian | On the momentum term in gradient descent learning algorithms[END_REF] while reducing the gradient oscillation induced by its instability. Then, to limit the vanishing and exploding gradient problems, the learning rate is monitored by the first and the second moment of the gradients, such that, this process also includes a bias correction induced by the initialization of the optimization algorithm.

To adequately train a parametric model F Θ , the Evaluator has to perform an optimization algorithm such as the gradient descent, the stochastic gradient descent or the mini-batch gradient descent in order to find the weights minimizing the empirical risk R(L, F Θ ). In order to perform such algorithm, the backpropagation principle has to be conducted in order to compute ∇ Θ R(L, F Θ (i) ). However, the Evaluator has to deal with many challenges as the choice of the loss function, the convergence towards a global minimum and the vanishing & exploding gradient issues. As no universal solution exists to solve these issues, the Evaluator has to find alternatives in order to limit their impact: e.g. , using the Adam optimizer, fine tuning the learning rate, finding a specific loss function to the side-channel context.

SUM UP. . .

Considering all the approaches we presented so far, the Evaluator can define a strategy, derived from Chapter 3, in order to construct a model which automatically extracts the secret key manipulated by a targeted cryptographic module. c Nevertheless, the readers should noticed that all the contributions, provided in this manuscript, can be easily extended to perform non-profiled side-channel attacks if the scenario introduced by Timon [Tim19] is followed.

Application to the

Similarly to the scenario of classical profiled side-channel analysis (see Figure 3.16), the Evaluator has to capture a set of leakage traces I p from a targeted cryptographic module. The main difference between both approaches lies in the statistical tools considered to estimate PDFs ( Pr [T, Y = y]) y∈Y for a given leakage trace T and a set of sensitive variable Y (see Figure 4.8).

Model construction.

In deep learning-based side-channel analysis context, the Evaluator has to configure a model F Θ which maps the leakage traces to the expected targeted sensitive variables. Hence, he has to define suited model hyperparameters in order to increase the ability of F Θ to retrieve the secret key. While no particular suggestions are provided to successfully construct a neural network in side-channel context, the literature recently investigates the benefits of using tools which automatically tune model hyperparameters [MPP16, BPS + 20, WPP20, PRA20, RWPP21, YAGF21]. Even if these suggestions are useful to generate powerful parametric models F Θ , the model hyperparameters space is often complex and high-dimensional as the Evaluator does not have any clues to construct an efficient neural network. Hence, the elapsed time, introduced in Subsection 1.2.2 as an evaluation criterion, can be highly impacted. In order to reduce this issue, Chapter 6 investigates the impact of model hyperparameters on the ability of a CNN to retrieve the points of interest. This proposition is helpful to give some hints to the Evaluator and reduces the model hyperparameters space as well as the elapsed time criterion.

Once the parametric model F Θ is designed, the Evaluator conducts the optimization process as described in Section 4.3.

Optimization. First, the Evaluator has to choose the most adequate loss function to train F Θ in order to retrieve the secret key manipulated by the targeted cryptographic module. While the negative log likelihood has been demonstrated as suited to conduct side-channel attacks, nonnegligible errors can be induced by this loss [START_REF] Masure | A comprehensive study of deep learning for side-channel analysis[END_REF]. One alternative could consider a loss function optimizing the success rate in order to adhere with the optimal adversary's objective (see Objective 3.3.1.1). A discussion and a proposition, reducing this issue, are detailed in Chapter 7. Then, in order to deal with the optimization challenges, the Evaluator can consider the solutions provided in Subsection 4.3.2, but some optimizer hyperparameters, as the learning rate or the number of iterations required by the descent gradient algorithm, stay problematic to optimize. Even if some solutions are proposed in the literature to optimize the learning rate [START_REF] Smith | Cyclical learning rates for training neural networks[END_REF][START_REF] Smith | Super-convergence: Very fast training of residual networks using large learning rates[END_REF], no generic rules can be stated. In contrast, the number of iterations of the gradient descent algorithm can be defined during the training process thanks to early stopping. This technique is considered to determine how long a gradient descent algorithm has to be iterated in order to obtain a parametric model generalizing well its performance on unseen leakage traces. In such purpose, a set of leakage traces T can be divided into two sets: a training set I p used to train F Θ , and a validation set I v used to evaluate the training process. Once the gradient descent algorithm has been performed on each leakage trace d included in I p , the Evaluator compares the ability of the parametric model to retrieve the secret key from I p with the unseen data included in I v . Typically, the machine learning literature classically considers the accuracy as a suited performance metric. However, as detailed in Subsection 3.3.4, this performance metric cannot be considered for all cryptographic algorithms. While the accuracy is adequate to assess the training process when an asymmetric cryptographic algorithm is targeted [CCC + 19, WPB19], the guessing entropy and the success rate are the most suited performance metrics to evaluate the optimization process of a parametric model against symmetric cryptographic implementations [CDP17a, PHJ + 18]. In such purpose, the community investigates various solutions to conduct early stopping in deep learning-based side-channel context. These solutions are based on: the success rate [RZC + 19], the mutual information [START_REF] Perin | Learning when to stop: a mutual information approach to fight overfitting in profiled side-channel analysis[END_REF] or the perceived information [START_REF] Masure | A comprehensive study of deep learning for side-channel analysis[END_REF]. Even if the early stopping technique is considered beyond the scope of this manuscript, this tool will be considered in Chapter 8 to prevent the overfitting issue and assess the quality of the training process against asymmetric cryptographic implementations. Once the optimization algorithm is performed, the Evaluator has a parametric model F Θ which approximates the true unknown PDFs (Pr [Y = y|T]) y∈Y . Hence, from the log-likelihood distinguisher defined in Definition 3.3.3.4, the Evaluator can guess the most likely key candidate for a given set of N a attack traces with a fixed key. Hence, the main difference between classical and deep learning-based side-channel approach holds in the estimation of the unknown PDFs. A deeper discussion will be provided in Part II in order to bridge the gap between these two approaches.

Explainability and Interpretability.

Once the parametric model F Θ is obtained, the Evaluator has to explain and interpret its decision-making in order to make sure that the resulted attacks succeed for appropriate reasons (e.g. the expected points of interest are successfully exploited). Furthermore, he also has to explain to the Developer, through the Evaluation Technical Report (see Subsection 1.2.2), the security flaws exploited by F Θ in order to find suitable countermeasures. Chapter 5 and Chapter 6 propose some visualization tools on diverse neural networks in order to ease the explainability and interpretability of the model's results.

When the Evaluator conducts an evaluation with neural networks, he wants to:

1. Adequately choose the space dimension of F in order to limit the underfitting/overfitting issues defined in Subsection 4.1.3.

2. Optimize the elapsed time criterion without altering the attack performance.

3. Explain and Interpret the model's results in order to highlight the security flaws and ease the design of suitable countermeasures by the Developer.

EVALUATOR'S GOALS

Apart from these problematics, the Evaluator can consider multiple deep learning approaches in order to enhance its evaluation. The following section summarizes the recent research directions proposed by the community.

Related Work

While the deep learning-based side-channel area is a recent field (see Figure 1.6), it is required to get a clear overview of the works provided by the community. This section aims at briefly introducing each research direction.

Preprocessing. Mitigate the Hiding countermeasures. The CNNs have been introduced in side-channel context to reduce the desynchronization effect due to its invariance translation property [START_REF] Cagli | Convolutional neural networks with data augmentation against jitter-based countermeasures -profiling attacks without pre-processing[END_REF]. Indeed, this neural network has shown surprisingly good performance against a wide range of hiding countermeasures as: random process operations [START_REF] Cagli | Convolutional neural networks with data augmentation against jitter-based countermeasures -profiling attacks without pre-processing[END_REF], shuffling [START_REF] Zotkin | Deep learning vs template attacks in front of fundamental targets: experimental study[END_REF][START_REF] Maghrebi | Assessment of common side channel countermeasures with respect to deep learning based profiled attacks[END_REF][START_REF] Maghrebi | Deep learning based side channel attacks in practice[END_REF], code polymorphism [MBC + 20], dummy operations [ZOB18, Mag19a, LH20]. However, even if CNNs are suited to limit the effect of desynchronization effect, Zhou and Standaert suggest considering alignment methods before training a neural network as they observed that the training process is faster on synchronized leakage traces [START_REF] Zhou | Deep learning mitigates but does not annihilate the need of aligned traces and a generalized ResNet model for sidechannel attacks[END_REF].

Architectures. While this thesis is mainly focused on the CNNs, other architectures have been studied in the literature: fully-connected neural networks [MZ13, MHM14, Wei20], ResNets [ZS19, JZHY20, GJS20, MS21], Generative Adversarial Networks [WCL + 20], RNN [LLY + 20], Transformer Neural Network [START_REF] Hajra | Transnet: Shift invariant transformer network for power attack[END_REF] or Attention mechanisms [LZC + 21]. However, the benefits of these neural networks regarding the CNN are not highlighted. This leads us to focus our interest only on the CNN. This suggestion will be confirmed in Chapter 6.

Multi-Task Learning. While classical supervised learning approaches generally train a parametric model to map a leakage trace to a sensitive variable, the multi-task learning consists in targeting simultaneously multiple sensitive variables for a given input. In [ZXF + 19], Zhang et al. decompose the output space Y to F n 2 with n = log 2 (|Y|). Hence, instead of targeting one word of n bits, they train a neural network to map a leakage trace to n words of 1 bit. By assessing the ability of a neural network to retrieve each bit, the Evaluator can identify the bits where the sensitive information is retrieved. Another solution consists in targeting simultaneously several intermediate operations and/or bytes. This approach has been proposed by Maghrebi [START_REF] Maghrebi | Deep learning based side-channel attack: a new profiling methodology based on multi-label classification[END_REF] and extended in [Mas20, Section 8.2.2]. Hence, instead of considering the "Divide & Conquer" strategy (see Subsection 3.3.1) which aims at repeating the training and the inference processes for each target (e.g. 16 times for an AES-128 implementation), the Evaluator can target multiple sensitive bytes in parallel, and thus, reduce the elapsed time criterion. On the other hand, if the Evaluator simultaneously targets several intermediate operations, the elapsed time criterion stays similar to the "Divide & Conquer" strategy, but the sensitive information exploited by the parametric model increases with the number of targeted intermediate information. Thus, the number of attack leakage traces that are needed to retrieve the secret key can decrease and the related Evaluator get closer to Objective 3.3.1.1. Even if the multi-task learning is a suited approach from a certification perspective, its study stays out of the scope of this manuscript.

Multi-Channel.

Another suited proposition from an evaluation point of view is to combine the source of different channels (e.g. power consumption and electromagnetic emanations) [SA08, YZC + 17]. The first works considering the deep learning approach to combine different channels are proposed in [GMGH19, HFL + 20]. More precisely, they collect electromagnetic emanations captured with multiple probes placed on different areas of the targeted cryptographic module, in order to capture different sources of information. Then, they construct a multi-channel neural network [START_REF] Kim | Convolutional neural networks for sentence classification[END_REF] that simultaneously operates on the related collected leakage traces. Similar approach is provided in [WHJ + 21b]. However, instead of considering different probe position, Won et al. combine multiple representations of the same leakage trace such as a reduced leakage trace resulting from the application of the Principal Component Analysis (PCA) algorithm or being subject to a moving average technique.

Portability. Classical profiled side-channel attacks imply attacking one cryptographic module with a leakage model generated from a similar copy, but this concept is known as a hard problem to deal with. Indeed, intrinsic differences between the cryptographic modules cause variations in the resulted leakage model and thus, can lead to an unsuccessful attack. While this thesis does not take into consideration this issue, known as portability, the following works [CCC + 19, WBFD19, BCH + 20, RBA20] aim to understand the effect of these variations on the resulted attack performance and propose solutions to reduce the portability issue. In [START_REF] Cao | Cross-device profiled side-channel attack with unsupervised domain adaptation[END_REF], Cao et al. add a constraint term to the loss function in order to fine-tune a model trained on a cryptographic module similar but not identical to the one used during the attack phase. In [START_REF] Van Der Valk | Kilroy was here: The first step towards explainability of neural networks in profiled side-channel analysis[END_REF], Van der Valk et al. use the Singular Vector Canonical Correlation Analysis tool to investigate internal similarities between fully-connected neural networks that targeted diverse implementations. In addition, the Evaluator can help the neural networks to reach a global minimum by providing further useful information that are beneficial to retrieve the targeted secret key. The approach, known as "domain knowledge", refers to the methods inserting additional knowledge to the neural network in order to enhance its performance. This knowledge can be integrated in the form of equations, logic rules, and prior distribution into the neural network. Hence, in addition to the leakage traces, the Evaluator can insert the plaintext as input of the neural network in order to encourage the secret key extraction [START_REF] Hettwer | Profiled power analysis attacks using convolutional neural networks with domain knowledge[END_REF][START_REF] Hoang | Plaintext: A missing feature for enhancing the power of deep learning in side-channel analysis? breaking multiple layers of side-channel countermeasures[END_REF]. However, from an evaluation perspective, the domain knowledge raises the following question: how to insert the new inputs such that the neural network can efficiently exploit its information?

Transfer Learning & Mimicking. As mentioned in Subsection 4.4.1, finding a suited neural network architecture is not a trivial task. A solution consists in refining parametric models that have been trained to solve different, but still similar, tasks. From these pre-trained parametric models, the Evaluator looks at reducing the time needed for constructing and training a new parametric model from scratch. From an evaluation perspective, this is highly beneficial because the reduction of the elapsed time criterion can be non-negligible. While the very first works demonstrate promising results [GMGH20, TAM20, vdVKPB20], transfer learning remains an open topic in the deep learning-based side-channel analysis.

Unsupervised. As the classical profiled and non-profiled side-channel attacks can be included in the supervised learning paradigm, the majority of the research direction is focused on this approach. In [START_REF] Perin | Keep it unsupervised: Horizontal attacks meet deep learning[END_REF], Perin et al. propose the first end-to-end unsupervised approach in deep learning-based side-channel attacks. Targeting a secure ECC implementation, they iteratively correct each bit by relabeling them following the confidence of the neural network. However, even if this work is a first insight of how to perform unsupervised learning in side-channel analysis, this approach is still unexplored. In [CLM20], Cristiani et al. suggest as a future work to extend the well-known Mutual Information Neural Estimator in an unsupervised way in order to conduct side-channel attacks.

To assess the benefits of these approaches, the deep learning side-channel community mainly applies their related propositions on a wide range of implementations described in Section 3.6. To perfectly use these datasets regarding the application of the deep learning approach in the sidechannel context, we have to decompose them into three subsets: a profiling set I p , a validation set I v and an attack set I a . The detailed decomposition is provided in Table 4.1 for each dataset considered in this manuscript.

Conclusion

To reduce the risk enounced at the end of Chapter 3, namely reducing the preprocessing phase, the Evaluator can adopt the deep learning paradigm in order to automatically find a model that maps a leakage trace to the related sensitive variable. In this chapter, we recall the definition of a learning algorithm and introduce the empirical risk minimization which is beneficial to adequately choose the algorithm that is the most powerful to complete a given task. However, even if the ERM is a suited tool to select a model, the related model space complexity can be problematic regarding the generalization purpose (see Equation 4.4). Indeed, following its complexity, the related model can encounter difficulties to perform well on unseen leakage traces. This issue is known as overfitting and can be mitigated through the application of the regularized empirical risk minimization principle which adds a penalty term to the empirical risk R.

To construct the learning algorithm, the Evaluator has to design a parametric function 2 be the secret key, then, the following assertions hold:

F
1. Let i ∈ [0, D -1], then, the minimum min ψ0, ψ1,..., ψD-1 E T[0] -ψ0 (f (X, k * )), T[1] -ψ1 (f (X, k * )), . . . , T[D -1] -ψD-1 (f (X, k * )) 2 is reached when ψ0 , ψ1 , . . . , ψD-1 = ψ 0 , ψ 1 , . . . , ψ D-1 such that (ψ i ) 0≤i<D
)|| 2 = D-1 j=0 a 2 j . Futhermore, if Pr[X = x] > 0 for all x ∈ F n
2 , the minimum is exclusively obtained for ψ = ψ.

For each

x ∈ F n 2 , we have ψ i (f (x, k * )) = E X=x [ψ i (f (x, k * )) + Z[i]].
Given a leakage trace T such that its i th time sample can be defined as

T[i] = ψ i (f (X, k * ))+Z[i],
the goal of the stochastic attack is to find an approximation of the leakage model, denoted ψi , as close as possible to the true unknown ψ i (f (X, k * )).

IN SHORT. . .

Approximation of ψ i . Let G be the set of functions mapping F n 2 to R which forms a R-vector space of dimension 2 n . More formally, G describes a set of pseudo-Boolean functions that can be defined as follows.

Definition 5.1.1.1 (Pseudo-Boolean function). [Car10, Section 2.1] Given a variable Y ∈ F n 2 , any function g ∈ G can be written as a multilinear polynomial such that there exists a set of real coefficients (α u ) u∈F m 2 (s.t. m ≤ n) as:

g α (Y ) = u=(u[0],...,u[m-1])∈F m 2 α u • Φ u (Y ),
where (Φ u (Y )) u∈F m 2 denotes the monomial basis of G and characterizes the conjunction of all bits of j] with Y [j] ∈ F 2 defines the j th bit of Y and the power notation is simply Y As the leakage model aims at characterizing the interaction between the bits of Y , Schindler et al. approximate ψ as a pseudo-Boolean function [START_REF] Schindler | A stochastic model for differential side channel cryptanalysis[END_REF] such that m = n. In the rest of this manuscript, this assumption is followed. Typically, the stochastic attack assumes that a leakage model ψ i , at a time sample i, can be approximated as a multivariate polynomial in the bit-coordinate Y [j] with coefficients in R.

Y as Φ u (Y ) = Y u = m-1 j=0 Y [j] u[
[j] 0 = 1 and Y [j] 1 = Y [j].
Definition 5.1.1.2 (Degree of a pseudo-Boolean function). Let g α : F n 2 → R be a pseudo-Boolean function. We denote d the degree of g α as the degree of the multilinear polynomial of the monomials (Y u ) u∈F n 2 (s.t. d ≤ n). In other words, the degree of a pseudo-Boolean function g α is defined by the Hamming Weight of u such that it characterizes the maximal number of bits' interaction induced in the approximation of ψ i (Y ). If we consider a subspace G d+1 that contains all the functions of degree lower than or equal to d, the approximation of the leakage model, denoted ψi,α , can be computed as follows: where α b [i] denotes the bias induced at the i th time sample. Following Equation 5.1, we can notice that the degree d represents the maximum number of bits' interaction that can be viewed as logical operator (e.g. AND or XOR).

ψi,α (Y ) = α b [i] + j<n α j [i]Y [j] degree 1 : linear basis + j1,j2 j 1 <n,j 2 <n α j1,j2 [i]Y [j 1 ] • Y [j 2 ]
Example 5.1.1.1 (Approximation of the linear basis.). To illustrate the idea of approximating a pseudo-Boolean function, we describe the behavior of a leakage trace such that its deterministic part ψ i is assumed to be in G 2 (i.e. d = 1). Hence, the pseudo-Boolean function is defined by a multilinear polynomial of degree 1 such that, given a sensitive variable Y ∈ F 8 2 , we observe:

ψi,α (Y ) = α b [i] + 7 j=0 α j [i]Y [j]. (5.2)
If all the bits (Y [j]) 0≤j<8 have the same positive weight values (α j [i]) 0≤j<8 , then, the leakage model can be characterized as a linear function defined in Figure 5.1. Hence, from a set of leakage trace T , the Evaluator wants to approximate ψ i such that Theorem 5.1.1.1 is respected. However, depending on the noise level, this approximation can be erroneous such that the higher the noise the less accurate the estimation ψi,α . More precisely, given a degree d, the Evaluator has to find the coefficients (α u ) u∈F n However, considering the monomial basis (see Definition 5.1.1.1) can be problematic from an interpretation perspective. Thus, the Evaluator, who wants to precisely assess the bits' interactions induced in ψ, has to consider another basis that we describe in the following section.

Approximation of the Leakage Model

Orthonormalizing the monomial basis. As defined in [START_REF] Sylvain Guilley | Stochastic sidechannel leakage analysis via orthonormal decomposition[END_REF], two requirements are mandatory to make an easy interpretation of the leakage structure. First, the basis of G should be orthonormal so that each vector that constitutes it is uncorrelated with each other. This requirement ensures that the Evaluator who wants to only approximate the leakage structure of degree d, i.e. retrieving the real coefficients (α u ) u∈F n 2 characterizing the interaction between bits, is not impacted by other terms induced in Equation 5.1. On the other hand, the chosen basis should be able to characterize the bit combinations in order to ease the resulted interpretability. While the monomial basis respects the latter requirements (see Definition 5.1.1.2), it is not orthonormal.

Remark 5.1.2.1. As a linear mapping exists between the non-orthogonal basis and its orthogonalized basis, the monomial basis can still be considered to perform a stochastic attack. Definition 5.1.2.1 (Orthonormal basis). Let G be the set of pseudo-Boolean function such that (Φ u ) u∈F n 2 forms a basis of G. We define (Φ u ) u∈F n 2 as orthonormal if the inner product Φ u ,

Φ v = 0 if u = v and Φ u , Φ v = 1 if u = v.
As defined in [GHMR17, Lemma 3], the monomial basis is not orthonormal.To circumvent this issue, Guilley et al. [START_REF] Sylvain Guilley | Stochastic sidechannel leakage analysis via orthonormal decomposition[END_REF] propose to decompose the monomial basis in order to isolate the leakages and assess the impact of each bit as well as their interactions on ψ. Thus, the authors apply a Gram-Schmidt Transform on the ordered a monomial basis. Through this application, they introduce a new orthonormal monomial basis that uncorrelates each basis vector and preserves the degree of bits' interaction. This solution is beneficial to evaluate the ability of ψα to retrieve the unknown leakage model ψ as well as maintaining its interpretability. Surprisingly, it is similar as an orthonormal projection of the leakage traces on the Fourier basis denoted Φ (orth.) u (Y ).

Definition 5.1.2.2 (Orthonormal Monomial Basis [START_REF] Sylvain Guilley | Stochastic sidechannel leakage analysis via orthonormal decomposition[END_REF]). Given a sensitive intermediate value Y ∈ F n 2 , the orthonormal projection of a monomial basis is defined as:

Φ (orth.) u (Y ) = 1 2 n/2 (-1) Y •u = 1 2 n/2 n-1 i=0 (1 -2 • Y [i]) u[i] ,
where u ∈ F n 2 .

Using the orthonormal monomial basis has a major benefit. As shown by Kasper et al. [START_REF] Kasper | A stochastic method for security evaluation of cryptographic fpga implementations[END_REF], when the basis is able to describe the switching activity of the circuit, the estimated basis coefficients highlight specific exploitable security flaws in the studied implementation. Hence, visualizing these coefficients (α u ) u∈F n 2 is useful to get deeper information on the exploitable security flaws. From Definition 5.1.2.2, we can rewrite Equation 5.1 as follows,

ψi,α (Y ) = 1 2 n/2 u∈F n 2 ψi , Φ (orth.) u • Φ (orth.) u (Y ) = 1 2 n/2 u∈F n 2 α u [i] • Φ (orth.) u (Y ).
(5.3)

Once the Evaluator adequately chooses its basis, he can approximate the leakage model ψ through a profiling phase and then, assessing its estimation through an attack phase.

a Here, this term refers to an ordering according to the monomial degrees.

Profiling phase. As defined in Theorem 5.1.1.1, the goal of the stochastic attack is to find a leakage model ψα characterizing a suited approximation of the real unknown leakage model ψ. Considered as a profiled side-channel attack, the stochastic attack can be decomposed into a profiling phase and an attack phase.

For the profiling phase, the stochastic attack mechanism approximates the leakage function using linear regression. Firstly, it consists in choosing the degree d of the pseudo-Boolean function that has to be estimated. Then, given a set of N p labeled leakage traces I p = {(t 0 , y 0 ), (t 1 , y 1 ), . . . , (t Np-1 , y Np-1 )}, the Evaluator estimates the leakage model ( ψi,α (Y )) Y ∈F n 2 by finding the best set of coefficients (α u [i]) u∈F n 2 through the application of the ordinary least squares (OLS) method. The law of large number theorem implies:

1 N p Np-1 j=0 (t j [i] -ψi,α (y j )) 2 OLS Np→∞ -→ E T[i] -ψi,α (Y )) 2 .
The set of coefficients (α u [i]) u∈F n 2 which minimizes this sum are called the OLS estimator for ψ. Once those coefficients are selected for each time sample i ∈ [0, D -1], the Evaluator obtains an estimation of the unknown leakage model (ψ i,α ) 0≤i<D . Then, he approximates the random part Z of a leakage trace T. In stochastic attacks, the noise Z is assumed to follow a multivariate Gaussian distribution N D (0, Σ). In order to approximate this distribution, the Evaluator has to compute a random vector, based on ( ψi,α ) 0≤i<D , that corresponds to the following approximation error vector:

Z α = T[0] -ψ0,α (Y ), T[1] -ψ1,α (Y ), . . . , T[D -1] -ψD-1,α (Y ) .
(5.4)

Once the profiling phase is performed, the Evaluator has approximated the true unknown leakage model ψ. Then, to retrieve the secret key manipulated by the targeted cryptographic device, he has to combine the knowledge it acquires from this modeling process. Based on Z α , the Evaluator constructs a D × D covariance matrix Σ Zα such that each of its element Σ

Zα [i, j] = Cov[Z α [i], Z α [j]].
To approximate Pr[T|Y ], the Evaluator aims at exploiting the information acquired during the profiling phase in order to extract the secret key k * manipulated by the targeted cryptographic module. Thus, given a new set I a of N a unlabeled leakage traces such that I a = {t 0 , t 1 , . . . , t Na-1 }, the Evaluator computes a random vector Z α,k for each key hypothesis k ∈ K following Equation 5.4. Once the N a random vectors (z α,k,i ) 0≤i<Na are generated, the Evaluator can compute the score related to k such that:

Pr z α,k,i |f (x i , k) = 1 (2π) D |Σ Z α,k | exp - 1 2 z T α,k,i Σ -1 Z α,k z α,k,i , (5.5) with |Σ Z α,k | the determinant of Σ Z α,k
that has been configured during the profiling phase. Then, this conditional probability is used by the Evaluator to make a decision regarding the most likely hypothetical key k ∈ K. The related decision rule is characterized by the distinguisher rule such that the log-likelihood distinguisher (see Definition 3.3.3.4) is performed:

k = arg max k∈K Na-1 i=0 log Pr z α,k,i |f (x i , k) .
Thus, he approximates the unknown leakage model ψ which maximizes the unknown conditional probability Pr [Z|f (X, k * )]. Estimating such probabilities is typically considered in profiled sidechannel attacks [CRR03, [START_REF] Schindler | A stochastic model for differential side channel cryptanalysis[END_REF][START_REF] Heuser | Good is not good enough[END_REF].

The limitations of the stochastic attacks approach are twofold: first, as the profiling phase aims at characterizing the interaction between the time samples, the covariance matrix Σ has to be constructed. However, the decision rule needs the computation of its inverse in order to guess which secret key is manipulated by the cryptographic module. Unfortunately, this process can lead to computational issues. One solution suggests to do not capture the interactions between the time samples and thus, reducing Σ to an identity matrix. Secondly, if the profiling phase is performed on a D-dimensional leakage trace T, the Evaluator has to conduct the related attack based on the computation of Equation 5.5 on the same dimension. However, once the profiling phase is performed, the Evaluator may want to reduce D to a lower dimension D , such that D ≤ D, through the visualization of the coefficients (α u ) u∈F n 2 for each time sample. Hence, due to the lack of flexibility of the attack phase, the Evaluator has to consider the full dimension D except if he conducts a new profiling phase on the reduced leakage traces of dimension D .

LIMITATIONS OF THE STOCHASTIC ATTACKS

Such problematic (i.e. the approximation of Pr[T|Y ]) can be solved by a deep learning approach belonging to the family of generative approaches. Indeed, given a leakage trace, the related learning algorithm can automatically approximate the decision boundary that maximizes the decision rule. The next section proposes a taxonomy of generative models to differentiate each solution in order to select the most suitable one from SCA perspective.

Taxonomy of Generative Models

Probabilistic generative approach captures the interactions between all the variables considered by the resulted learning algorithm. To comply with this technical specification, the strategy consists in building a model that estimates the probability distribution of the leakage traces, namely Pr [T]. Hence, this experience Exp (see Definition 4.1.1.1) can be considered as the application of an unsupervised learning process. However, to fit with the side-channel context (i.e. supervised learning), the joint probability distribution, Pr [T, Y ], has to be estimated such that, afterwards, the Bayes' theorem can be computed in order to retrieve the conditional posterior probabilities Pr [Y |T] and pick the most likely label Y . However, in the side-channel context, this problem can be reduced to the estimation of the following conditional probability distribution Pr [T|Y ] (see Equation 3.4). Hence, to deal with this observation, a generative model should be designed in order to estimate a Θ-parametric conditional distribution Pr [T|Y, Θ] that is as similar as possible to the true unknown conditional distribution Pr [T|Y ]. Through this approach, the Evaluator estimates the unknown leakage function and gets a complete characterization of the targeted cryptographic module. This is beneficial for modeling new sets of leakage traces from the Θparametric model.

To conduct such estimation, Goodfellow [START_REF] Goodfellow | NIPS 2016 tutorial: Generative adversarial networks[END_REF] exposes two solutions (see Figure 5.2):

• Explicit density estimation which explicitly computes an approximation of the true unknown conditional probability distribution Pr [T|Y ].

• Implicit density estimation generates a Θ-parametric model F Θ which draws leakage traces from the underlying true unknown conditional probability distribution Pr [T|Y ] without explicitly defining it.

Explicit density estimation.

Pr [T|Y ] = D-1 i=0 Pr [T[i] | T[i -1], T[i -2], . . . , T[0], Y ] .
Through this process, the idea is to use neural networks to model the dependencies between the time samples. This solution is highly effective because it permits to directly optimize a Θparametric function from the log-likelihood of a set of leakage traces. However, in the side-channel context, the sensitive variables only leak over a very few PoIs (see Figure 3.4) in comparison to the dimension of a targeted leakage trace. Thus, regarding the dimension of a leakage trace, the time samples are poorly correlated. In addition, the main drawback of this method is that it suffers from slow sequential sampling b . Thus, its application during the evaluation can be limited because of the elapsed time criterion. However, the readers interested in the autoregressive density estimation method may refer to [vdOKE + 16, vdODZ + 16, Goo17].

On the other hand, if Pr [T|Y ] is intractable, the related Θ-parametric model is denoted as an explicit model requiring approximation. This estimation suggests designing a surrogate loss function L such that the resulted empirical risk R optimizes the related Θ-parametric model

F Θ to converge towards Pr [T|Y ]. R (L, F Θ ) ≥ -log (Pr [T|Y ]) .
b For example, a significant drawback of WaveNet [vdODZ + 16], considering an explicit tractable density estimation, is its sequential (non-parallelizable) generation of samples. As reported in [START_REF] Goodfellow | NIPS 2016 tutorial: Generative adversarial networks[END_REF], it requires 2 minutes of computation time to generate 1 second of audio.

In such scenario, it is possible to find a surrogate loss function that is computationally tractable while Pr [T|Y ] is not, and thus, approximating the related unknown conditional probability distribution. Introduced in [START_REF] Kingma | Auto-encoding variational bayes[END_REF], the variational auto-encoder is the main solution considered by the literature. In Section 5.2, this solution is investigated in the side-channel context in order to bridge deep learning and classical profiled side-channel attacks.

Implicit density estimation.

Alternatively, some models can be optimized without explicitly producing density functions. Thus, the related computation can be eased in comparison to the explicit density estimation approaches. While the previous approach needs to retrieve an approximation of Pr [T|Y ], this scenario optimizes a model to draw new leakage traces based on a set of pairs (T, Y ) that are independently and identically distributed according to the unknown joint distribution Pr [T, Y ]. Thus, the related models indirectly interact with Pr [T|Y ]. To optimize such algorithms, the Evaluator can follow the Markov chain process or conduct a direct approach with the application of Generative Adversarial Networks (GANs). Introduced in [GPAM + 14], the GANs are characterized by two neural networks: a "generator" and a "discriminator". The goal of such models is to design a generator which aims at constructing fake leakage traces such that, the discriminator cannot differentiate it from real leakage traces. Hence, through this process, the Evaluator implicitly characterizes Pr [T|Y ]. In [WCL + 20], Wang et al. illustrate the benefits of the conditional Generative Adversarial Networks [START_REF] Mirza | Conditional generative adversarial nets[END_REF] to improve the performance of profiled side-channel attacks in a restricted setting where profiling traces are limited. Indeed, the authors consider the conditional Generative Adversarial Networks as a preprocessing phase consisting in implicitly capturing the conditional probability distribution Pr [T|Y ] in order to increase the number of profiling leakage traces. Once the profiling set is sufficiently large, the Evaluator can consider it to perform a deep learning-based side-channel attack as introduced in Chapter 4. This data augmentation technique has then been extended by Mikhtar et al. [START_REF] Mukhtar | Fake it till you make it: Data augmentation using generative adversarial networks for all the crypto you need on small devices[END_REF] to target asymmetric cryptographic implementations. While this approach seems helpful for generating new sets of leakage traces, no relation is made to perform an end-to-end attack.

The following section proposes the first deep learning-based side-channel approach which derives from the stochastic attack previously introduced. It reduces the gap between the deep learning approach and the classical profiled side-channel attacks by bridging the stochastic attacks with the variational auto-encoder introduced in the deep learning literature.

Conditional Variational AutoEncoder based on Stochastic Attacks

Generative Latent Variable Models

As a remainder, the variational autoencoder [START_REF] Kingma | Auto-encoding variational bayes[END_REF] Suppose that a leakage trace T ∈ R D is acquired such that all the time samples are simultaneously generated. To obtain a coherent leakage trace, it is clear that the time samples cannot be sampled independently from each other as it corresponds to the computation of a cryptographic function (e.g. encryption) given a plaintext X and a secret key k * . In particular, these variables suggest that the assignment of a label on a leakage trace T only depends on a small set of time samples. The conditional variational autoencoder is a latent variable model which suggests that the variability in the leakage traces given a label Y can be characterized by a small finite set of time samples. This is highly correlated with the definition of points of interest introduced in Definition 3.2.2.2. With this approach, the interactions between the time samples are captured through the latent space V.

A Θ-parametric latent variable model F Θ , providing a Θ-parametric conditional distribution Pr [T|Y, Θ], is representative of the true unknown conditional distribution Pr [T|Y ], for every leakage trace T and every given sensitive variable Y , if there is a representation of compressed data V, also known as latent space representation, such that the marginal distribution is given by:

Pr [T|Y, Θ] = v∈V Pr [T|Y, v, Θ] Pr [v|Y ] dv, ( 5.6)
where v is the realization of a random variable V in a D -dimensional space V, with a probability Pr [V = v] defined over V, and Pr [V = v|Y ] denotes the probability of observing v over the latent space V knowing Y . While the latent space characterizes the noise distribution defined in Equation 3.1, we can easily assume that Pr [V|Y ] = Pr [V] because V is independent of the label Y (deeper details will be provided in the following paragraphs). In addition, we assume that Pr [V] follows a multivariate Gaussian distribution of parameters (µ, Σ). Through the conditional variational autoencoder, we wish to optimize Θ such that we can sample V from Pr [V], and obtain, with high probability, a new generated leakage trace T very similar to the true known T. However, Equation 5.6 is unfortunately intractable as it should be computed for every latent representations induced in the latent space V. Thus, the following part of the section proposes solutions to circumvent this issue.

PROBLEM STATEMENT

Hopefully, Pr [T|Y, Θ] may still be efficiently approximated thanks to the Monte-Carlo method : R D × F n 2 → R D , that is called the encoder. Remark 5.2.1.1. As the conditional variational autoencoder is composed by an encoder and a decoder, a distinction has to be made related to the trainable parameters considered in both models. Hence, in the rest of the manuscript, we denote as F Θ,φ the resulted generative model such that, for a given leakage trace T,

F Θ,φ (T, Y ) = F (dec) φ • F (enc) Θ • (T, Y ).
Remark 5.2.1.2. Typically, an encoder is used to process a dimensionality reduction by reducing the number of features (i.e. time samples) that describes the input while preserving the main relevant information in the latent space V. Thus, in most cases, the dimensionality of the latent space is chosen to be lower than the dimensionality of the input space from which the leakage traces are drawn. As the aim of this chapter is to bridge deep learning and classical profiled side-channel attack, the following part assumes that D = D.

Latent Space Estimation and Instances' Generation

Through the description of the stochastic attack (see Section 5.1), the Evaluator can construct a conditional variational autoencoder adapted for the side-channel context.

Encoder.

As mentioned, it aims at modeling a neural network F (enc) Θ : R D × F n 2 → R D that takes a D-dimensional leakage trace and returns an approximation of µ V ∈ R D and Σ V ∈ M D,D (R) such that it can be used to characterize an element in the latent space V of dimension D. This element describes the behavior of the targeted cryptographic module (see on the left part of Figure 5.3). In this regard, we design the encoder F (enc) Θ such that it characterizes the leakage model ψ(Y ) and the random part Z of a leakage trace T in order to fit with the stochastic attack process. To build a suited encoder, the related neural network should follow the structure defined in Section 5.1 in order to extract the maximum amount of relevant information from leakage traces. First, the Evaluator has to estimate the deterministic part of a leakage trace T (i.e. leakage model ψ) that is defined by Equation 5.3. This modeling can be estimated by a fully-connected layer of D neurons such that each of them is linked with all elements of the orthonormal monomial basis c Φ (orth.) u . Let Y ∈ F n 2 and let (Φ

(orth.) u (Y )) u∈F n 2 (resp. ψi,Θ (Y )) be the input (resp. output) of the i th neuron such that: ψi,Θ (Y ) =   1 2 n/2 u=(u[0],...,u[n-1])∈F n 2 Θ u [i] • Φ (orth.) u (Y )   ,
where (.) is a function (linear or non-linear) and Θ ∈ M . While our work is to reduce the gap between deep learning and classical profiled side-channel attacks, we decide to define (.) as the identity function in order to satisfy d ψΘ [i] = ψα [i] and consider that the deterministic part of leakage trace at time sample i can be approximated by a single neuron. In the rest of the manuscript, this layer will be denoted as ψΘ (see Figure 5.3). Once the noise-free part ψΘ is estimated, the next step is to deeply characterize the noise part Z using leakage traces and the neurons of ψΘ layer. In the conditional variational autoencoderbased stochastic attack, we choose to deliberately force the subtraction of the leakage traces at time sample i and the i th neuron of ψΘ layer in order to fit with Equation 5.4. Then, the c The Evaluator can consider the monomial basis (see Definition 5.1.1.1) interchangeably. However, using this basis leads to a loss of interpretability as defined in Subsection 5.1.2.

1+ d-1 i=0 ( n i ),D (
d As a remainder, ψα is defined Equation 5.3. Decoder. Once the encoder is constructed, the Evaluator can capture the parameters µ V,Θ and Σ V,Θ which are needed to design the related Gaussian noise distribution N D (µ V,Θ , Σ V,Θ ). From a new sample V ∼ N D (µ V,Θ , Σ V,Θ ), the Evaluator designs a decoder F (dec) φ : R D ×F n 2 → R D (see on the right part of Figure 5.3) such that given G d+1 , containing all the Boolean functions of degree lower or equal to d, he wants to maximize the conditional probability distribution Pr [T|Y, V, φ], i.e. building a new leakage trace T ∈ R D as similar as possible to the related real trace T and defined as follows:

Encoder Decoder

T[i] = 1 2 n/2 u=(u[0],...,u[n-1])∈F n 2 φ u [i] • Φ (orth.) u (Y ) ψi,φ +V[i].
(5.7)

Note that a latent variable V ∈ R D is initially sampled from the prior distribution Pr [V] such that the dimension of V should correspond with the dimension of the latent space estimated by the encoder. However, performing the training process in such configuration can be arduous. Indeed, the backpropagation process described in Subsection 4.3.1 cannot be performed because the Evaluator has to compute the gradient of the loss function with respect to samples (i.e. latent variable V ∈ V), which is inherently non-differentiable.

To circumvent this issue, the reparametrization trick [START_REF] Kingma | Auto-encoding variational bayes[END_REF] proposes to rewrite V such that the derivative can be computed with respect to the parametric distributions (i.e. µ V,Θ and Σ V,Θ ) that are differentiable. Instead of generating samples from N D (µ V,Θ , Σ V,Θ ), sampling is performed from ∼ N D (0, I D ), followed by the computation of

V = µ V,Θ + Σ 1 2 V,Θ × .

REPARAMETRIZATION TRICK

Once V is constructed, the Evaluator has to approximate the deterministic part of the leakage model, namely ψφ . As already mentioned for the encoder, its estimation can be made with a fully-connected layer such that the input of size D is characterized by (Φ

(orth.) u (Y )) u∈F n 2 for a given Y ∈ F n 2 .
Because the Evaluator classically wants to characterize all the input time samples, the number of nodes in the ψφ layer depends on the dimensionality of the latent space, i.e. dimension of V (see Figure 5.3). Based on ψφ and V, the Evaluator can then build a new trace T following Equation 5.7.

Then, to adequately find the trainable parameters Θ and φ, the Evaluator has to consider some learning metrics that aims at approximating Pr[T|Y ].

Learning Similarities

As defined in Subsection 5.2.1 and Subsection 5.2.2, our generative model has to optimize a set of parameters φ and Θ in order to maximize the marginal log likelihood log(Pr [T|Y, φ]).

= E v∼F (enc) Θ log Pr [T, v|Y, φ] Pr [v|T, Y, φ] = E v∼F (enc) Θ log Pr [T, v|Y, φ] Pr [v|T, Y, Θ] • Pr [v|T, Y, Θ] Pr [v|T, Y, φ] = E v∼F (enc) Θ log Pr [T, v|Y, φ] Pr [v|T, Y, Θ] + E v∼F (enc) Θ log Pr [v|T, Y, Θ] Pr [v|T, Y, φ] = E v∼F (enc) Θ [log (Pr [T, v|Y, φ]) -log (Pr [v|T, Y, Θ])] + D KL (Pr [V|T, Y, Θ] ||Pr [V|T, Y, φ]) .
Unfortunately, due to the intractability of Pr[V|T, Y, φ] (see Subsection 5.2.1), Equation 5.8 cannot be solved in practice. Hence, we have to define a function such that log(Pr[T|Y, φ]) can be approximated through an optimization algorithm. In [START_REF] Kingma | Auto-encoding variational bayes[END_REF], Kingma and Welling propose a variational lower bound on the marginal likelihood which was generalized by Sohn et al. on conditional marginal likelihood [START_REF] Sohn | Learning structured output representation using deep conditional generative models[END_REF].

Theorem 5.2.3.2. [START_REF] Sohn | Learning structured output representation using deep conditional generative models[END_REF] For any choice of encoder F (enc) Θ and trainable parameters Θ, the variational lower bound of the conditional log-likelihood log(Pr[T|Y, φ]) is defined as:

log (Pr [T|Y, φ]) ≥ -D KL (Pr [V|T, Y, Θ] ||Pr [V]) + E v∼F (enc) Θ [log (Pr [T|Y, v, φ])] .
(5.9)

Proof. log (Pr [T|Y, φ]) = E v∼F (enc) Θ [log (Pr [T, v|Y, φ]) -log (Pr [v|T, Y, Θ])] + D KL (Pr [V|T, Y, Θ] ||Pr [V|T, Y, φ]) ≥ E v∼F (enc) Θ [log (Pr [T, v|Y, φ]) -log (Pr [v|T, Y, Θ])] = E v∼F (enc) Θ [log (Pr [v|Y, Θ]) -log (Pr [v|T, Y, Θ])] + E v∼F (enc) Θ [log (Pr [T|Y, v, φ])] = -D KL (Pr [V|T, Y, Θ] ||Pr [V|Y, Θ]) + E v∼F (enc) Θ [log (Pr [T|Y, v, φ])] .
As mentioned in Subsection 5.2.1, the prior distribution Pr [V|Y, Θ] can be reduced to Pr [V] because V is independent from the label Y and Θ.

The equality between Equation 5.8 and Equation 5.9 holds if and only if the encoder F 5.9, we define the empirical risk that we minimize to train the conditional variational autoencoder based on stochastic attacks. Definition 5.2.3.1 (Empirical risk combined with Evidence Lower BOund (ELBO) Loss). Given a latent space V, a set of N p labeled leakage traces I p = {(t 0 , y 0 ), . . . , (t Np-1 , y Np-1 )}, we define the empirical risk optimizing F Θ,φ , that approximates the generative distribution Pr [T|Y ], as follows: seeks to reconstruct T from v. Classically used for training a variational autoencoder, the loss function defined in Equation 5.10 can be decomposed into two terms: the reconstruction and the KL-divergence terms. To get a better reconstruction loss, the embedding means µ V,Θ are pushed far away from each other and embedding standard deviations Σ V,Θ are pulled toward zero. To get smaller D KL (Pr [V|T, Y, Θ] ||Pr [V]), the embedding means are pulled toward zero and the embedding standard deviations are pulled toward one. While the KL-divergence term is opposed to the reconstruction loss, it can be seen as a regularization term. Indeed, putting a lot of information about T in V makes reconstruction trivial, but the penalization induced by the regularization term is non-negligible. Therefore, the regularization term acts as an information bottleneck, so a balance between both terms must be found. If necessary, the KL-divergence loss can be monitored by a hyperparameter β. In the state-of-the-art, these models are called β-Variational AutoEncoders [HMP + 17]. However, the impact of the β-parameter on the resulted learning algorithm is considered as out of the scope of this manuscript.

R (L ELBO , F Θ,φ ) = 1 N p Np-1 i=0 D KL (Pr [V|t i , y i , Θ] ||Pr [V]) KL-Divergence Loss -E v∼F (enc) Θ log (Pr[t i |y i , v, φ])
Reconstruction Loss. This term, denoted by E v∼F (enc) Θ log (Pr[T|Y, v, φ]), is linked with the decoder F (dec) φ introduced in Subsection 5.2.2. It defines the probability of constructing T given the label Y and a sample v of the latent space V of size D. Hence, the reconstruction loss tends to maximize the log likelihood in order to construct leakage traces that are correlated with the true unknown leakage model ψ and the noise Z related to T. Thus, it encourages the decoder to learn how a leakage trace can be reconstructed from a given noise representation defined by a latent variable V. The reconstruction loss optimizes the parameters φ to retrieve the correct coefficients associated with each vector of the orthonormal monomial basis Φ (orth.) u such that the probability distribution in latent space V is defined by a multivariate Gaussian distribution N D (µ V,Θ , Σ V,Θ ). Typically, if we only consider the case where no interaction between the time samples of T occurs, then, the covariance matrix Σ V,Θ can be simplified to a diagonal matrix such that its vector representation can be described as

σ 2 V,Θ = [Σ V,Θ [0, 0], Σ V,Θ [1, 1], . . . , Σ V,Θ [D, D]].
In such configuration, we do not expect to capture the time samples' interaction related to the constructed leakage trace T ∈ R D . Thus, the reconstruction loss can be computed as follows:

E v∼F (enc) Θ -log (Pr [T|Y, v, φ]) = E v∼F (enc) Θ D-1 i=0 1 2 log 2πσ 2 T[i] + (T[i] -µ T[i]) 2 2σ 2 T[i]
,

(5.11)

with µ T[i] (resp. σ 2 T[i])
indicates the i th element of the mean (resp. variance) vector of generated leakage traces T given a latent representation v and a deterministic part ψφ which depends on Y = f (X, k * ) (see Equation 5.7). Thus, assuming that Σ V,Θ can be simplified to a diagonal matrix affects the ability of the generated leakage trace T to capture the interaction between the time samples of T. While this choice can be problematic from a performance perspective e , the computation gain is non-negligible as the matrix inversion does not have to be computed in order to process the reconstruction loss. Then, we assume that the output distribution of the conditional variational autoencoder is an isotropic Gaussian (i.e. for all v ∼ N D (µ V,Θ , diag(Σ V,Θ )), we can define Σ T = σ 2 •I D where σ 2 is a scalar). While the Mean Squared Error (MSE) loss function f can be written as E v∼F (enc) Θ ||T-µ T|| 2 , Equation 5.11 can be simplified as follows:

E v∼F (enc) Θ -log (Pr [T|Y, v, φ]) = 1 2 log 2πσ 2 + E v∼F (enc) Θ ||T -µ T|| 2 2σ 2 .
(5.12)

Note that this solution is minimized if the scalar

σ 2 = E v∼F (enc) Θ ||T -µ T|| 2 = MSE [Yu20].
This loss is approximated via Monte-Carlo sampling, however, due to computation constraints, we consider only one sample v for computing Equation 5.12 during the training process. Consequently, for an estimated leakage trace T, we minimize its L 2 -norm from the related true leakage trace T in order to find the best parameters φ. This result is in line with Theorem 5.1.1.1 from which the stochastic attack is designed. In other words, through this solution, we attempt to find an estimated leakage trace T as similar as the real one T. Thus, the decoder F Through this configuration, the KL-divergence can be computed as follows:

D KL (Pr [V|T, Y, Θ]||Pr [V]) = E v∼F (enc) Θ [log(Pr [v|T, Y, Θ]) -log(Pr [v])] = E v∼F (enc) Θ 1 2 log |I D | |Σ V,Θ | - 1 2 (v -µ V,Θ ) T Σ -1 V,Θ (v -µ V,Θ ) + 1 2 (v -0) T I -1 D (v -0) = - 1 2 log (|Σ V,Θ |) - 1 2 E v∼F (enc) Θ (v -µ V,Θ ) T Σ -1 V,Θ (v -µ V,Θ ) + 1 2 E v∼F (enc) Θ v T I -1 D v = - 1 2 log (|Σ V,Θ |) - 1 2 tr(Σ -1 V,Θ Σ V,Θ ) + 1 2 µ T V,Θ I -1 D µ V,Θ + tr(I -1 D Σ V,Θ ) = 1 2 -log (|Σ V,Θ |) -tr(I D ) + µ T V,Θ • µ V,Θ + tr(Σ V,Θ ) .
(5.13)

As Σ V,Θ can be rewritten as a vector σ 2 V,Θ such that each element of (σ 2 V,Θ [i]) 0≤i<D defines the i th diagonal of Σ V,Θ , then, Equation 5.13 can be expressed as follows:

D KL (Pr [V|T, Y, Θ] ||Pr [V]) = - 1 2 log D-1 i=0 σ 2 V,Θ [i] + D-1 i=0 1 - D-1 i=0 µ 2 V,Θ [i] - D-1 i=0 σ 2 V,Θ [i] = - 1 2 D-1 i=0 1 + log σ 2 V,Θ [i] -µ 2 V,Θ [i] -σ 2 V,Θ [i] . While the KL-divergence measures how the Pr[V|T, Y, Θ] distribution is different from Pr[V],
standardizing input traces is helpful to reduce the impact of irrelevant time samples.

To clearly explain the impact of the KL-divergence loss on the learning process, let us denote T a D-dimensional leakage trace that has been standardized at each sample (zero mean, unit variance). Let {l 0 , . . . , l u-1 } defines a set of indices where the sensitive information leaks (i.e. PoIs) such that,

T[i] = ψ(Y )[i] + Z[i] ∼ N (0, 1) if i ∈ {l 0 , . . . , l u-1 }, Z[i] ∼ N (0, 1)
otherwise.

In this setting, we assume that the interactions between trace samples are negligible. Thus, if the leakage trace T is standardized, each time sample has a zero mean and unit variance. Hence, if the i th time sample of T has no deterministic part (i.e. ψ(Y ) = 0), the related element of the latent variable

V[i] = Z[i] -ψΘ (Y )[i] follows N (0, 1) which induces that ψΘ [i] is negligible.
Consequently, if i / ∈ {l 0 , . . . , l u-1 }, the related sample of the latent variable follows the same distribution as Z[i]. Thus, in such scenario, the KL-divergence loss is negligible while the latent representation does not contain any information about the secret key k * . Thus, considering these non-informative time samples does not affect the regularization term and are unsuitable for the decision process. This result encourages the Evaluator to only consider the time samples with a non-negligible deterministic part. On the other hand, if i ∈ {l 0 , . . . , l u-1 }, then

V[i] = ψ(Y )[i] + Z[i] -ψΘ (Y )[i] follows N (0, 1). Thus, it suggests that Z[i] ∼ N (E[ ψΘ (Y )[i] -ψ(Y )[i]], V[ψ(Y )[i]] + V[ ψΘ (Y )[i]] + V[V[i]] -2 • Cov[ψ[i], ψΘ [i]] -2 • Cov[ψ[i], V[i]] + 2 • Cov[ ψΘ [i], V[i]]
). However, due to the KL-divergence loss function involving during the training process, we force the latent variable (V[i]) 0≤i<D to follow N D (0, I D ). As defined in Subsection 5.2.2, this latent variable characterizes an estimation of the noise Z induced in the leakage trace T. Thus, during the training process of the cVAE-ST, we penalize the model to tend

E[ ψΘ (Y )[i] -ψ(Y )[i]] towards 0 and V[ψ(Y )[i]] + V[ ψΘ (Y )[i]] + V[V[i]] -2 • Cov[ψ[i], ψΘ [i]] -2 • Cov[ψ[i], V[i]] + 2 • Cov[ ψΘ [i], V[i]
] towards 1 such that this solution is reached if and only if ψΘ = ψ. Consequently, when KL-divergence loss is computed, the conditional variational autoencoder aims at optimizing the trainable parameters Θ of the encoder F (enc) Θ such that the regularization term equals 0 if and only if Θ is optimal. This justification suggests that the latent space should be only composed by points of interest. One solution is to consider dimensionality reduction techniques. In addition, when the Gaussian noise increases, the dependence between T[i] and ψ[i] decreases. In this configuration, differentiating the sensitive information from the noise can be difficult as Z[i] approximately follows N (0, 1) regardless the information included in the time sample i. This observation demonstrates the benefits of the noise to reduce the efficiency of side-channel attacks.

Once the generative model F Θ,φ is trained, the Evaluator has to make a decision following the approximation of Pr[T|Y ] in order to fit with the stochastic attack approach (see Subsection 5.1.2). The following section describes this strategy.

Decision Rule & Network Complexity

Typically, the inference phase of conditional variational autoencoder consists in generating new set of data based on an input and a conditional known label. In the side-channel context, our goal is different and tends to find the conditional unknown label Y that fits the best for a given trace T. The following part describes the proposed solution to retrieve the secret key from the model previously defined.

Key Extraction Phase.

During the training phase, we defined a function F Θ,φ that approximates log(Pr[T|Y, φ]) through an optimization algorithm (i.e. gradient descent-based algorithms) such that the generated leakage trace T, defined by the output of the decoder F (dec) φ , are close to the real one T captured for a given label. Based on these new generated traces T, the Evaluator can find the key hypothesis that approximates the marginal likelihood. Let I a be a set of N a attack traces such that I a = {t 0 , . . . , t Na-1 }. For each of these attack traces, the Evaluator can compute the related label Y = f (X, k) mixing the known plaintexts X ∈ X and a key hypothesis k ∈ K. Then, the Monte Carlo method can be performed to get an estimation of Pr [T|Y, φ]. Hence, for a set of N v latent samples {v 0 , . . . , v Nv-1 }, we can compute an approximation of the marginal log-likelihood as follows: To enhance the key extraction phase, the Evaluator can precisely define the PoIs' indexes via a leakage assessment once the profiling phase is performed. Indeed, if Θ and φ are correctly learned, the Evaluator can visualize them in order to properly select the points of interest (see Subsection 5.3.1). Thus, during the attack phase, the Evaluator can only compute Equation 5.14 on the samples that are considered as relevant by the conditional variational autoencoder based on stochastic attacks.

log (Pr [t i |y i , φ]) ≈ -D KL (Pr [V|t i , y i , Θ] ||Pr [V])- 1 2 log   2π • D-1 j=0 t i [j] - 1 N v Nv-1 h=0 th [j] 2   - 1 2 , ( 5
Theoretical Network Complexity Bounds. Based on the previous sections, we can efficiently find an architecture for a given implementation. Consequently, some theoretical network complexity bounds can be expressed following the Evaluator's knowledge. Indeed, our generative neural network can be easily built for a given Y ∈ F n 2 , a degree d (s.t d ≤ n) of bits' interaction and a D-dimensional leakage trace T ∈ R D . First, for estimating ( ψΘ [i]) 0≤i<D (resp. ( ψφ [i]) 0≤i<D ), the encoder (resp. decoder) needs to optimize Θ (resp. φ) in order to retrieve the correct leakage model. Hence, for a given Y ∈ F n 2 , the number of weights that has to be optimized is ((1 + d-1 i=0 n i ) • D) in both cases. Then, for estimating (V[i]) 0≤i<D (resp. ( T[i]) 0≤i<D ), we have to link the i th sample of the leakage trace T (resp. the noise V) with the related ψΘ [i] (resp. ψφ [i]). Here, we decide to follow the classical stochastic models in order to easily extract the related noise. Hence, no weights are needed for this operation. Finally, to approximate µ V,Θ (resp. Σ V,Θ ), we need (D • (D + 1)) (resp. D 2 • (D + 1)) neurons. For the simplified diagonal case, Σ V,Θ can be reduced to σ 2 V,Θ , thus, only D • (D + 1) neurons are needed in this configuration. To sum up this complexity, the Evaluator needs to construct a generative model with (D

• ((D + 1) 2 + 2 • (1 + d-1 i=0 n i ))) weights (resp. (2D • ((D + 1) + 1 + d-1 i=0 n i )) weights if Σ V,Θ is reduced to σ 2 V,Θ
). If a leakage assessment is performed before the construction of the generative model, then, the Evaluator can extract a subset of indices defining the time samples where the sensitive information leaks (i.e. PoIs). For example, if the Evaluator detects u PoIs, he can construct a vector {l 0 , . . . , l u-1 } of u indices such that l i denotes the index related to the i th point of interest. Based on this knowledge, he can build a conditional variational autoencoder with lower complexity such that most of the relevant information, chosen to be related to the u PoIs, can be extracted from a leakage trace. Instead of considering all the samples of the D-dimensional trace (D ≥ u), he can construct a neural network with (u

• ((u + 1) 2 + 2 • (1 + d-1 i=0 n i ))) weights (resp. (2u • ((u + 1) + 1 + d-1 i=0 n i )) weights if Σ V,Θ is reduced to σ 2 V,Θ
). As a consequence, we drastically reduce the network complexity without altering the ability of the generative model to retrieve the secret key as suggested in Subsection 5.2.3. For example, the network complexity of Figure 5.3 is about 1, 040 weights if all bits' interactions are considered (i.e. d = 8, u = 2, n = 8).

The goal of the conditional variational autoencoder based on stochastic attacks is to approximate the true unknown conditional probability Pr[T|Y ] from a neural network

F Θ,φ = F (dec) φ • F (enc) Θ .
To perform such estimation, the Evaluator has to respect the following steps:

1. Construct the encoder F (enc) Θ and the decoder F (dec) φ in order to respect the stochastic attacks structure defined in Section 5.1. The Evaluator can refer to Subsection 5.2.2 in order to design suited model.

Train the conditional variational autoencoder with the empirical risk combined with evi-

dence lower bound loss (see Definition 5.2.3.1) in order to maximize the similarities between new generated leakage traces T and the real one T.

3. Extract the secret key manipulated by the cryptographic module through the application of the decision rule described in Subsection 5.2.4.

SUM UP. . .

One of the main benefits of the proposed variational autoencoder is its explainability and its interpretability regarding the side-channel context. In addition, our theoretical results suggest that its width does not have to be large no matter the dimension of the leakage traces. This result is faithful with the Universal Approximation Theorem (see Theorem 4.2.1.1). Through the following section, we validate these properties and broaden the attacks' spectrum on protected implementations considering Boolean making scheme.

Investigations on the Constructed Generative Model

Through this section, we validate all the theoretical observations provided in Section 5.2 without optimizing the hyperparameters selection. While classical discriminative models need to tune a lot of hyperparameters introduced in Subsection 4.2.2 and Subsection 4.3.1 (i.e. type of neural network structure, number of layers, number of nodes per layer, activation function, optimizer algorithms, learning rate, number of epochs, batch size), the configuration of the proposed conditional variational autoencoder based on stochastic attacks only considers the optimizer algorithm g , the batch size, the learning rate and the number of epochs. In this section, optimization is done using the Adam algorithm on batch size {8, 16, 32, 64, 128} and the learning rate is set to {10 -4 , 10 -3 , 10 -2 , 10 -1 }. We construct each model with the following number of epochs {10, 20, 30, 40} and select the parameters that provide the best ranking value. Finally, in this section, N t rank denotes the number of attack traces that are needed to reach a constant rank of 1. The attack leakage traces are randomly shuffled and picked up from a set of attack leakage traces I a which is characterized by simulations that are described in the following. For a good estimation of N t rank , an average over 10 simulations, denoted N t rank , is computed. Finally, as the goal of this basis is to ease the explainability and the interpretability of the results provided by our generative model, the basis that is considered for estimating the leakage model ψ is the orthonormal monomial basis Φ (orth.) u defined in Definition 5.1.2.2.

The next section proposes to visualizes the trainable parameters Θ and φ in order to assess the suitability of the conditional variational autoencoder to extract the expected leakage model ψ.

Leakage Model Visualization

To evaluate the benefits of the generative model to retrieve the correct basis, we simulate a set of 10, 000 traces (9, 000 for the profiling phase and 1, 000 for the validation phase) through multiple scenarios:

• Scenario 1 -We assume that each leakage trace is configured by 3 time samples such that only 1 point of interest is considered. The leakage model induces the maximum amount of interactions between bits (i.e. G 9 , see Definition 5.1.1.2) such that all bits influencing the leakage model have the same weighting. Hence, the i th time sample of the simulated trace T is defined as follows:

T[i] =                    1 • Y [1] + 1 • Y [3] + 1 • Y [6] + 1 • ⊕ 1 b=0 Y [b] + 1 • ⊕ 2 b=0 Y [b] + 1 • ⊕ 3 b=0 Y [b] + 1 • ⊕ 4 b=0 Y [b] + 1 • ⊕ 5 b=0 Y [b] + 1 • ⊕ 6 b=0 Y [b] + 1 • ⊕ 7 b=0 Y [b] + Z[i] if i = 1, Z[i] otherwise, (5.15)
where

⊕ n b=0 Y [b] = Y [0] ⊕ . . . ⊕ Y [n], Y [b] = Sbox[X ⊕ k * ][b]
denotes the b th bit of the output of the Sbox, and Z[i] is a Gaussian noise following N (0, σ 2 ) such that σ 2 ∈ {0.1, 1, 10}.

• Scenario 2 -We assume that each leakage trace is configured by 4 time samples such that only 2 points of interest are considered. The leakage model does not induce interactions between bits (i.e. d = 1 and G 2 ) but differs by the location of the points of interest. Hence, the i th time sample of the leakage trace T is defined as follows:

T[i] =    1 • Y [3] + 1 • Y [6] + Z[i] if i = 1, 1 • Y [1] + 1 • Y [7] + Z[i] if i = 2, Z[i]
otherwise,

(5.16)

g This observation is an intrinsic property of the proposed neural network architecture. For example, if the Evaluator wants to construct an encoder in order to reduce the desynchronization effect as well as the trace dimension, he has to deal with model hyperparameters.

where

Y [b] = Sbox[X ⊕ k * ][b] and Z[i] is a Gaussian noise following N (0, σ 2 ) such that σ 2 ∈ {0.1, 1, 10}.
Different levels of noise are considered for all scenarios in order to get an overview into how F Θ,φ performs depending on the SNR result but their results are provided in Appendix A.

As mentioned in Section 5.2, the encoder (resp. decoder) is trained to retrieve the parameters Θ (resp. φ) in order to maximize their correlation with the targeted leakage model. Once the generative model is correctly trained, the Evaluator can visualize these trainable parameters (i.e. Θ and φ) in order to find the security flaws induced in the studied implementation. In all scenarios (see Figure 5.4), the weight visualization can be used to assess the ability of the encoder (resp. decoder) to retrieve the leakage function defined in each scenario (i.e. Equation 5.15, Equation 5.16). Indeed, these figures illustrate the coefficient associated to each vector of the orthonormal monomial basis. The first coefficients of each figure define the lowest bits' interaction induced in the leakage model. For example, the first element, included in the interaction of degree 5 area, is characterized by

⊕ 4 b=0 Y [b].
While the related weight is non-negligible, the conditional variational autoencoder based on stochastic attacks identifies the following interactions ⊕ 4 b=0 Y [b] in the leakage model. This observation can be confirmed with Equation 5.15. Proceeding this analysis for the entire set of non-negligible weights can be helpful to evaluate the ability of the generative model to retrieve the leakage model. Indeed, if we compare the real simulated leakage model defined in Equation 5.15 with the non-negligible weights depicted in Figure 5.4a, we can see that all the peaks are associated with the correct basis vector. This observation can be extended when the leakage model varies following the targeted time sample (see Figure 5.4b). In addition, each coefficient associated with the sensitive interactions seems to get approximately the same impact which corresponds to the real leakage function defined in Equation 5.15. Consequently, if the conditional variational autoencoders based on stochastic attacks are correctly trained, they sound helpful to retrieve complex leakage models and the related security flaws. Through the additional simulations provided in Appendix A, our generative model can be considered to evaluate the security flaws when large bits' interactions are observed, when the deterministic part is different for all PoIs and when different weighting occurs. As a consequence, large use-cases can be considered when the cVAE-ST is applied. Moreover, through the visualizations provided in Figure 5.4, the Evaluator can also identify the time samples where the sensitive information leaks. Indeed, Figure 5.4a (resp. Figure 5.

4b) highlights that only t[1] (resp. t[1] and t[2]

) is useful to extract the leakage model. Hence, once the generative model is correctly trained, the Evaluator can easily retrieve the points of interest. Then, during the attack phase, the Evaluator can decide to focus its attack by computing Equation 5.14 only on a small set of relevant samples instead of the entire trace dimension as mentioned in Subsection 5.2.4. One advantage of the stochastic model is to approximate the data that depends on the secret key. Through this process, the Evaluator directly obtains a score related to the key manipulated by the cryptographic module. Hence, the Evaluator can adapt the orthonormal monomial basis to target simultaneously multiple cryptographic primitives (e.g. input and output of the Sbox) h .

The following section explores the ability of the conditional variational autoencoder to perform such simultaneous attacks.

Multi-Sensitive Variable Attacks

To evaluate the benefits of our generative model to retrieve the multiple sensitive variables, we simulate a set of 10, 000 leakage traces (9, 000 for the profiling phase and 1, 000 for the validation phase). In the following scenario, t is a 4-dimensional leakage trace such that 2 points of interest are configured. The i th time sample of the leakage trace T is defined as follows:

T[i] =          1 • (X ⊕ k * )[5] + 1 • (X ⊕ k * )[3] ⊕ (X ⊕ k * )[7] + Z[i] if i = 1, 1 • Sbox [X ⊕ k * ] [3] + 1 • Sbox [X ⊕ k * ] [6] + Z[i] if i = 2, Z[i]
otherwise,

(5.17

)
where Sbox [X ⊕ k * ] [b] denotes the b th bit of the output of the Sbox considering a plaintext X and the secret key k * , Z[i] is a Gaussian noise following N (0, σ 2 ) such that σ 2 = 1.

To exploit all the bits' interaction for each sensitive variable, we set d = 8 and compute two orthonormal monomial basis, i.e. (Φ

(orth.) u (X ⊕ k * )) u∈F n 2 et (Φ (orth.) u (Sbox [X ⊕ k * ]
)) u∈F n 2 , such that Figure 5.5 illustrates the impact of each vector of each basis in G 9 . When the time sample t[1] is considered, we can see an interaction of degree 1 and 2 that corresponds to the bit 5 and the interaction between the bits 3 and 7 of the input of the Sbox. Then, through Figure 5.5, we can see that t[2] extracts a leakage model with two interactions of degree 1. When we refer to Equation 5.17, we observe that the true leakage model depends on 3 th and the 6 th bit of the Sbox output. Hence, through this simulation, we can validate the ability of the conditional variational autoencoder to correctly retrieve the leakage model of multiple sensitive variables simultaneously. However, as mentioned in Subsection 5.2.4, the degree d of the orthonormal monomial basis G d+1 directly affects the complexity of the conditional variational autoencoder based on stochastic attacks. Hence, considering the attacks of multi-sensitive variable increase by 2D • (1 + d-1 i=0 n i ) the number of trainable parameters (i.e. weights) for each new targeted sensitive variable i . Thus, depending on his computational capacity, the Evaluator has to define the most suitable structure to employ for defeating the targeted cryptographic module.

However, the Evaluator can wonder how does the conditional variational autoencoder retrieves the points of interest when widely uninformative samples are considered. The following section answers this question.

Curse of Dimensionality

When the Evaluator performs a side-channel attack, he wants to precisely find the relevant keydependent time sample even if a large part of the leakage trace contains uninformative time samples. Usually, the number of points of interest u is far lower than the trace dimension D (i.e.

h Similar proposition was introduced by Maghrebi for the discriminative models [START_REF] Maghrebi | Deep learning based side-channel attack: a new profiling methodology based on multi-label classification[END_REF]. But its investigation on discriminative models is not considered in this thesis.

i This number can be reduced to 2u

u D)

. Thus, to assess the benefits of the conditional variational autoencoder in side-channel attacks, we have to understand the ability of this new generative model to retrieve the points of interest when a lot of samples are irrelevant. In order to evaluate it under this restriction, a wide range of datasets are simulated (see Section 3.6) with different levels of D. We construct 6 scenarios where D ∈ {3, 10, 50, 100, 500, 1000} and u = 1 such that the noisy samples follows a Gaussian distribution with parameters µ = 0 and σ 2 = 1. The related SNR equals to 0.549. Hence, for each case study, only a single PoI is configured while the dimension of the simulated leakage traces increases. In Table 5.1, we denote P RI = u D , the percentage of relevant information in each scenario and evaluate the impact of this variable on other parameters, namely the batch-size and the learning rate. Finally, N v denotes the number of samples V used to perform Equation 5.14. As suggested in Subsection 5.2.4, the attack process is performed only on the time sample defined as relevant j by the generative model. Hence, the weight visualization applied on φ and Θ is very helpful to define which samples can be considered as PoIs. Through Table 5.1, we can see that j Here, the relevance of a time sample is characterized by its coefficients φ and Θ such that the most relevant have the highest coefficients. increasing D does not impact the resulted performance of the generative model (i.e. N t rank ). Indeed, if the evaluator adequately finds the correct hyperparameters, namely batch-size and learning rate, he can expect to get similar results for high values of D. However, as detailed in Subsection 5.2.4, increasing the input dimension highly impacts the complexity of the conditional variational autoencoder. Finding a way to focus the interest of the model only on the relevant time samples can drastically reduce the network complexity (see Definition 4.2.2.3) without altering its resulted performance. Such investigation could be part of a future work.

Once the Evaluator validates the ability of the generative model to deal with a low percentage of relevant information, he can question the benefits of the conditional variational autoencoder to defeat Boolean masking implementations. The next section deeper investigates this protection against this type of generative model.

Generalization on Boolean Masking Implementation

Typically, the generative approach approximates the leakage model without altering its representation in order to get a global characterization of Pr[T|Y ] with T the leakage trace and Y the related label. Consequently, our generative approach does not automatically recombine the PoIs but preserve the network's explainability that is mandatory for the evaluation process. Thus, if the Evaluator has to face with a masking implementation, the preprocessing phase, introduced in Section 3.5, has to be performed. As a remainder, a masking scheme of order d -1 consists in a d-sharing of the sensitive variables {Y 0 , Y 1 , . . . , Y d-1 }. In our setting, this corresponds to a situation where the leakages of the d shares are hidden among values that have no relation with the target. As defined in Section 3.5, the Evaluator has to combine the leakage traces in order to reveal the dependence of the leakage trace T and its related label Y . To evaluate the suitability of the conditional variational autoencoder in such scenarios, we decide to simulate 5-dimensional leakage traces with different levels of masking order d ∈ {0, 1, 2, 3}. For each case study, we apply the product (see Equation 3.8), the absolute difference (see Equation 3.9) and the optimal product (see Equation 3.10) combining functions and list the best result obtained in Table 5.2. Through this table, we demonstrate the ability of the proposed generative model to defeat a high-order Boolean masking implementation. Surprisingly, the number of shares does not highly impact the hyperparameters' value k , namely the learning rate and the batch-size, unlike the network complexity. Indeed, for a given set of D-dimensional leakage traces, the combining methods multiplied by D the number of time samples for each mask reduction. Hence, for performing a d order attack, the Evaluator has to deal with leakage traces of D d+1 samples. As the dimension of the leakage traces impacts the network complexity (see Subsection 5.2.4), the Evaluator has to exponentially increase his computational ability with the order of the side-channel attack.

Once all these simulations validate the theoretical observations provided in Section 5.2, we compare the benefits of considering the new conditional variational autoencoder with the classical profiled side-channel attacks on real unprotected and protected implementations.

Practical Experiments

The experiments are implemented in Python using the Keras library [START_REF] Chollet | [END_REF] and are run on a workstation equipped with 128GB RAM and a NVIDIA GTX1080Ti with 11GB memory. The configurable hyperparameters, namely the batch-size and the learning rate, are respectively set to {8, 16, 32, 64} and {10 -3 , 10 -2 , 10 -1 }. We construct each model with the following number of epochs {10, 20, 30, 40, 50, 75, 100} and select the value that provides the best rank. As mentioned in Section 5.3, we denote N t rank the average value of N t rank over 10 shuffled experiments. In the following, we always capture the maximum amount of interactions (i.e. G 9 ). This choice was made because we assume that the Evaluator does not have a priori knowledge on the bits' interactions. This section considers three datasets that have been presented in Section 3.6, namely DPA contest-v4, AES_HD and ASCAD-v1. All these experiments can be reproduced through the following reference [ZBC + 21a].

A Comparison with Classical Generative Side-Channel Attacks

In this section, we evaluate the benefits of the conditional variational autoencoder against the classical side-channel attacks (i.e. template attacks, stochastic attacks). We respect the same conditions as the state-of-the-art result. Hence, we construct a pooled template attack [START_REF] Choudary | Efficient template attacks[END_REF] and a pooled stochastic attack [START_REF] Choudary | Efficient stochastic methods: Profiled attacks beyond 8 bits[END_REF] that consist in manipulating different key hypotheses k ∈ K with different means but the same covariance. Thus, we pool the covariance matrices into a single solution in order to cope with statistical difficulties. For the DPA contest-v4 and AES_HD datasets, Kim et 12]). While no clear description of high-order attack is defined in [BPS + 20], we select the 8 most relevant samples related to the mask and the masked values and then, apply the three combining functions introduced in Section 3.5.

DPA contest-v4.

Once the conditional variational autoencoder is trained, the Evaluator can observe the coefficients related to each time sample as illustrated in Figure 5.6a. Then, he can select those with the highest trainable parameters (i.e. Θ and ψ) and perform his attack on this subset. For this dataset, we compute Equation 5.14 on the 50 time samples previously extracted. When a high-SNR unprotected implementation is considered, we observe that our generative model has the same performance as classical profiled side-channel attacks (see Table 5.3). Hence, for this implementation, similar results can be obtained whatever the attack performed. Consequently, in this configuration, considering the conditional variational autoencoder based on stochastic attacks is equivalent to classical profiled side-channel attacks.

AES_HD.

Following the state-of-the-art results [KPH + 19], a pooled template attack needs approximately 25, 000 attack traces to retrieve the secret key. Surprisingly, performing the stochastic attack on the same dataset highly improves the related performance. Indeed, when this approach is considered, the Evaluator can recover the secret key with 4, 500 attack traces which is 5.5 times better. Finally, when our generative model is applied, an even better attack can be performed. As mentioned in Subsection 5.2.4, the attack phase is based on sample similarity measures. Hence, the Evaluator can only compute Equation 5.14 on the relevant samples detected during the profiling phase. Thus, we drastically reduce the impact of the uninformative samples during the attack phase. In this configuration, we only consider the samples where the related φ coefficients are greater than 0.5 (see Figure 5.6b). Accordingly, while the training process was performed on traces with 50 samples, the computation of Equation 5.14 was made on the 14 time samples complying with the restriction configured. This processing tremendously increases the performance of the resulted attack. Indeed, the cVAE-ST model divides by 100 (resp. 18) the number of attack leakage traces that are needed to perform a pooled template attack (resp. pooled stochastic attack).

ASCAD-v1.

As mentioned in Section 3.5, we perform high-order attacks with the help of combining functions as preprocessing (i.e. product combining, optimal product combining, absolute difference combining). Then, we profile the generative models on the unmasked value in order to extract the relevant information. In Table 5.3, the optimal product combination provides the best performance on the ASCAD-v1 dataset. Through this experiment, we observe that the conditional variational autoencoder performs better than template and stochastic attacks. While 351 (resp. 290) attack traces are needed to reach a constant rank of 1 when the pooled template attacks (resp. pooled stochastic attack) are considered, our generative model retrieves the secret key within 190 attack traces. As previously mentioned for the AES_HD dataset, this result can be explained by the ability of the conditional variational autoencoder to target a specific range of relevant combined time samples during the attack phase. On the contrary, the classical profiled side-channel attacks have to consider the 64 time samples (i.e. 8 time samples related to the masks and the masked value) used to perform the related attacks. Hence, resulted noisy time samples can highly influence the performance of the resulted attacks.

In conclusion, the conditional variational autoencoder based on stochastic attacks provides similar performance as the pooled template attack and the pooled stochastic attacks. However, when a classical profiled side-channel attack is trained on D-dimensional traces, the Evaluator has to perform the exploitation phase on the same leakage trace dimension. Unfortunately, the Evaluator does not know a priori which time samples are considered as relevant once the profiling phase is applied. Hence, performing the exploitation phase on the D-dimensional leakage traces could be impacted by the uninformative time samples. On the other hand, once the profiling phase is performed on the D-dimensional traces, our generative model is beneficial to select a subset of u time samples, such that u D, in order to compute Equation 5.14 only on the informative time samples (i.e. points of interest). Hence, this new proposition is more flexible than classical profiled side-channel attacks.

However, the generative approach can be limited by multiple factors, the following section highlights these limitations.

Benefits & Limitations of cVAE-ST

As previously illustrated, the conditional variational autoencoders can be considered in sidechannel context in order to perform physical attacks and extract the secret key from a cryptographic module. From an evaluation perspective, this new neural network architecture is suitable as it respects the following requirements:

1. Theoretical similarities with classical profiled side-channel attacks -As illustrated in Section 5.2, the conditional variational autoencoder can be monitored to fit with the stochastic attacks paradigm introduced by Schindler et al. [START_REF] Schindler | A stochastic model for differential side channel cryptanalysis[END_REF] and recalled in Section 5.1. From the Evaluator point of view, this approach is useful to ease the configuration of the neural network and get a clear overview of the decision-making process. Indeed, as the conditional variational autoencoder is designed on well-known theoretical attack strategy, the Evaluator can be confident on the employed neural network structure and thus, expect to get a resulted predictive model as efficient as classical profiled side-channel attacks, namely template attacks and stochastic attacks. From this new bridge, the Evaluator can deeply understand the future improvements that can be provided in order to fully exploit the automation process in side-channel context.

2. Explainability & Interpretability -One major benefit of the proposed neural network architecture is to preserve the interpretability and the explainability on the results provided by the learning algorithm. As the conditional variational autoencoders are constructed from the classical profiled side-channel attacks, the Evaluator can adapt its interpretation tools (e.g. visualization) in order to deeply explain the results provided by the model. As suggested in Subsection 5.3.1 and Subsection 5.4.1, the Evaluator can visualize the trainable parameters of the conditional variational autoencoder in order to assess the ability of the encoder and the decoder to retrieve a hypothetical leakage model as similar as possible to the true unknown ψ. Once the Evaluator retrieves an approximation of ψ, he highlights the security flaws induced by the targeted implementation and thus, can alert the Developer on potential vulnerabilities and ease the development of countermeasures.

3. Hiding countermeasures -Even if this manuscript does not assess the robustness of the conditional variational autoencoder based on stochastic attacks against desynchronization effect l , an intuitive solution suggests to add convolutional layers to the encoder. However, it should be validated in practice. While this intuition could be a suitable solution to mitigate the desynchronization effect, it also helps the network to automatically select the points of interest and prevent the effect of uninformative time samples. Indeed, as defined in Subsection 5.2.3 and Subsection 5.2.4, the empirical risk as well as the decision process are only affected by the points of interest. Hence, this dimensionality reduction technique can also be useful to quadratically reduce the network complexity.

However, the conditional variational autoencoder based on stochastic attacks also has some limitations that are listed below.

1. Combining function -As the generative approach, as well as classical profiled sidechannel attacks, captures the conditional distribution Pr[T|Y ], it cannot handle masking implementations as the targeted unmasked sensitive variable Y is not directly observable through the leakage trace T. Thus, the Evaluator has to consider combining functions in order to reveal the dependence between T and Y . Unfortunately, this suggests the need of preprocessing phase which is not necessarily optimal from an attack perspective. Indeed, as this combining function is not automatically learned by the generative model, the Evaluator may not converge towards the optimal solution and reaches Objective 3.3.1.1. . This approach is notably beneficial to automatically find a suited combining function and thus, enhancing the high-order attacks. Furthermore, as the discriminative model directly computes Pr [Y |T, Θ], it generally outperforms generative models at conditional prediction tasks [START_REF] Ng | On discriminative vs. generative classifiers: A comparison of logistic regression and naive bayes[END_REF]. However, discriminative models need to be configured more carefully than generative approach. Hence, if a discriminative model is not well constructed, a generative solution can be more suitable to optimize the conditional Θ-parametric probability distribution Pr [Y |T, Θ] after the application of the Bayes' Theorem. In the following chapter, we propose to deeply investigate the notion of discriminative approach in order to ease the construction of neural networks in deep learning-based side-channel attacks.

Performance

Conclusion

In this chapter, we bridge the deep learning paradigm with a classical profiled side-channel attack, namely stochastic attack. Hence, we design a new conditional variational autoencoder from the attack proposed by Schindler et al. [START_REF] Schindler | A stochastic model for differential side channel cryptanalysis[END_REF] and highlight its similarities with the theoretical foundations of stochastic attacks (see Section 5.2). This development leads us to investigate the ability of the Evaluator to explain and interpret the results provided by the generative model. Indeed, by visualizing the trainable parameters (i.e. Θ and φ), the Evaluator retrieves the leakage model approximated by the conditional variational autoencoder as well as the points of interest induced in the targeted implementation. Through this process, he can assess the suitability of the resulted model. Then, we validate the benefits of our approach under traditional restrictions, namely low percentage of relevant information and Boolean masking implementations. Finally, the conditional variational autoencoder based on stochastic attacks is more flexible than classical profiled side-channel attacks. Indeed, while template attacks and stochastic attacks consider the same leakage traces' dimension during the profiling phase and the attack phase, our generative model can conduct the key extraction phase on a smaller dimension (i.e. points of interest) and therefore, reduce the impact of uninformative time samples on the attack performance.

However, the conditional variational autoencoder based on stochastic attacks does not automatically combine the leakage function in order to deal with Boolean masking implementations. Thus, a preprocessing phase is still needed for the Evaluator. A solution to this issue is to consider the discriminative approach. As suggested in [START_REF] Ng | On discriminative vs. generative classifiers: A comparison of logistic regression and naive bayes[END_REF], a discriminative model, that is well designed, converges towards a better solution and classically outperforms a generative learning algorithm. Nevertheless, as no particular correlation has been made with the side-channel context, its configuration is considered as an arduous task. To mitigate this issue, Chapter 6 exploits some visualization tools introduced by the deep learning community, in order to understand how the model hyperparameters affect the ability of the convolutional neural network to retrieve the points of interest. We illustrate their impacts and propose a new convolutional structure for a discriminate perspective.

WHAT'S NEXT?

Chapter 6

Designing Discriminative Models in Profiled Side-Channel Analysis

In this chapter, we develop an approach for evaluating the impact of model hyperparameters induced in convolutional neural networks. First, we recall the restrictions the Evaluateur has to deal with and define some issues that have to be reduced in order to optimize the evaluation process. Thus, we adapt visualization tools introduced in the deep learning literature in order to enhance the understanding of the discriminative models and to reduce the black box issue that characterized it. Then, a focus is made on the hyperparameters which composed the convolutional part of a CNN in order to investigate the impact of the length of the filters, the pooling operation and the number of the convolutional blocks on the ability of the convolutional part to extract the points of interest from a leakage trace. Finally, we design a methodology which reduces the impact of uninformative time samples by focusing the interest of the neural network on the points of interest only. This results in drastically reducing the network complexity as well as the training time without altering the neural network performance. The solutions proposed in chapter have been presented at CHES and published in the journal IACR TCHES [ZBHV19b].

Contents

Discriminative Models in Certification process

In The Reality of Evaluator's World

As mentioned in Subsection 1.2.2, the robustness of a cryptographic module is assessed by a cotation table which is based on some criteria, namely elapsed time, adversary's expertise, knowledge of the target of evaluation (TOE), access to TOE, equipment and tools. The combination of these criteria provides a score to the Evaluator that reflects the difficulty of conducting an attack. Thus, during the certification process, the Evaluator aims at optimizing these criteria in order to perform the most efficient attack within the shortest time. Indeed, as the elapsed time is the most flexible criterion that the Evaluator has to deal with, he aims at designing discriminative models which approximate the optimal adversary (see Objective 3.3.1.1) with a minimum amount of time.

To design discriminative models, the Evaluator typically considers the fully-connected neural networks or the convolutional neural networks as they have been proven to be effective against Boolean masking implementations [MPP16, MDP19b] and hiding countermeasures [CDP17a, ZOB18, Mag19a, Mag19b, MBC + 20, ZOB18, Mag19a, LH20]. While both countermeasures can be mitigated by convolutional neural networks, the rest of this chapter will be focused on its construction. However, designing such neural networks is an arduous task because of the plethora of model hyperparameters a that are involved in the construction of the CNNs. Indeed, as mentioned in Subsection 4.2.2, a CNN can be decomposed into two parts, namely feature selection part and classification part, such that the model hyperparameters that characterized them differ:

• Feature selection part -as a remainder, this part extracts the sensitive information (i.e. points of interest) from a leakage trace T in order to help the decision-making. Typically, the Evaluator has to deal with the following model hyperparameters: the number of convolutional blocks, the number of convolutional layers per convolutional block, the number and the length of filters, the activation function applied on each layer, the stride value, the padding value, the pooling operation and the pooling stride.

• Classification part -as a remainder, this part is defined by numerous fully-connected layers characterized by the following model hyperparameters: the number of fully-connected layers, the number of neurons per fully-connected layers and the activation function that has to be applied on each layer.

To deal with the model hyperparameters space, the Evaluator uses tools which automatically tune the model hyperparameters values in order to find the most efficient solution from an adversary's perspective [MPP16, BPS + 20, WPP20, PRA20, RWPP21, YAGF21]. However, if the Evaluator has no intuition about how the model hyperparameters values should be bounded, the time needed to find a good predictive model can be tremendously impacted.

Black-box issue.

Because a discriminative model can be seen as a black-box tool, the lack of interpretability is a major drawback for constructing a neural network as well as explaining the decision-making of the Θ-parametric model. Hence, in deep learning-based side-channel attack, the configuration of the profiling phase is an arduous task for the Evaluator. One solution to reduce these bounds is to get a better intuition on the decision-making of the predictive models in order to understand how it retrieves the secret key manipulated by a targeted cryptographic module. A common technique to perform such investigations is to visualize the model's behavior that is selected by the learning algorithm.

The following section defines the gradient visualization tool [START_REF] Masure | Gradient visualization for general characterization in profiling attacks[END_REF] as a solution for assessing the ability of a model to exploit the points of interest, and denotes its limitation regarding the grasp of the model hyperparameters' impact.

a We recall that this term has been introduced in Definition 4.2.2.4.

Evaluation of Discriminative Models

As mentioned in Subsection 3.2.2, the signal-to-noise Ratio is a useful tool to identify the time samples that depend on the targeted sensitive variable. However, this solution cannot be considered to evaluate the intrinsic ability of a parametric function F Θ to retrieve the related points of interest as the SNR tool does not depend on a distinguisher b . Alternatively, some visualization tools have been introduced by the deep learning community in order to interpret the results provided by F Θ .

Gradient visualization.

Introduced in [START_REF] Simonyan | Deep inside convolutional networks: Visualising image classification models and saliency maps[END_REF], the gradient visualization has been investigated by Masure et al. in the side-channel context [START_REF] Masure | Gradient visualization for general characterization in profiling attacks[END_REF]. To use this tool, two assumptions are needed. The first assumption c states that the points of interest are non-uniformly distributed over a D-dimensional leakage trace T such that the set {l 0 , . . . , l u-1 }, which defines the coordinates related to each point of interest, has a smaller dimension than D (i.e. u D). Hence there are only a few time samples that depend on the sensitive variable Y . The second assumption d considers that a Θ-parametric model F Θ : T → P(Y) is differentiable over T.

To evaluate F Θ with the gradient visualization tool, the Evaluator computes the derivatives of the model with respect to a leakage trace T such that the magnitude of the derivatives indicate which time samples need to be modified the least to affect the prediction the most. In other words, following the value of the gradient of F Θ at the i th time sample, the Evaluator can assess if i is included in the set of points of interest {l 0 , . . . , l u-1 } such that, for a given sensitive variable Y , he expects that,

∂ T[i] F Θ (T)[Y ] = 0 if i ∈ {l 0 , . . . , l u-1 }, ≈ 0 otherwise. (6.1)
Thus, the gradient visualization is useful for identifying the time samples that influence the most the prediction of F Θ . Comparing these time samples to the points of interest, the Evaluator is able to assess the suitability of the selected model F Θ to solve the side-channel classification task which consists in mapping a leakage trace to the true sensitive variable Y . More concretely, the gradient visualization can be considered to:

1. Detect the time samples that the model considers as correlated with the targeted sensitive information Y (see Equation 6.1).

2. Assess the impact of each time sample to solve the classification task. Indeed, for a given time sample i, a gradient with a large magnitude ensures that the information included at i has a huge impact on the PMF and consequently, on the classification task.

Thus, comparing the gradient visualization with the signal-to-noise ratio is a relevant solution to the Evaluator in order to interpret the suitability of the model F Θ for retrieving the time samples which affect the most its predictions. However, this tool highlights the impact of time sample's variation on the final decision, but not the decision-making itself. Consequently, the layer-wise relevance propagation [BBM + 15] have been introduced in order to mitigate this issue by directly bridging the visualization tool with the decision of F Θ . In [HGG20], Hettwer et al.

propose a comparison between the gradient visualization, the layer-wise relevance propagation and the occlusion approach e such that no clear benefit has emerged for one of those methods. As the gradient visualization tool provides some theoretical coherence with the side-channel context, this manuscript is only focused on the gradient visualization tool for the evaluation of the overall model's behavior F Θ .

b Following Definition 3.3.1.3, a parametric function F Θ can be defined as a distinguisher. c This assumption is called Sparsity in [START_REF] Masure | Gradient visualization for general characterization in profiling attacks[END_REF]. d This assumption is called Regularity in [START_REF] Masure | Gradient visualization for general characterization in profiling attacks[END_REF].

e The occlusion technique consists in removing some time samples from the leakage trace in order to observe how it impacts the model's predictions.

Limitations. However, these techniques are not ones required to understand how the feature selection part or the convolutional part affects the decision process as they only give a general interpretation of how a neural network performs. One solution to reduce this issue is to find local visualization tools that evaluate the impact of model hyperparameters to retrieve the points of interest.

The following section adapts two visualization tools widely used in deep learning, namely weight visualization and heatmaps. Through the application of these approaches, we want to get a better understanding of the model hyperparameters which characterized the feature selection part of a convolutional neural network.

Evaluation of the Feature Selection

One way to interpret the suitability of a neural network to solve a classification task is to visualize how the configuration of its model hyperparameters affects the points of interest's selection.

As mentioned in Subsection 4.2.2, we assume that a convolutional neural network can be decomposed into a feature selection part, which extracts the points of interest from a leakage trace, and a classification part, which combines those relevant time samples in order to make a decision regarding the classification task to solve. In this chapter, we assume that, once the neural network adequately retrieves the points of interest, the classification part can be easily designed. In addition, compared to the classification part, the configuration of the feature selection part is the most arduous task due to the plethora of model hyperparameters (see Subsection 6.1.1). Thus, adapting some visualization tools to the side-channel context can be beneficial to highlight the impact of those hyperparameters to retrieve the points of interest and consequently, ease the design of convolutional neural networks for the Evaluator as well as reducing the elapsed time criterion.

VISUALIZATION'S GOAL

Thus, the Evaluator has to consider visualization tools which allow an independent interpretation of the feature selection part, i.e. leave apart the classification component of the convolutional neural network, such that he can evaluate the Network Confidence to retrieve the points of interest. Hence, the higher the network confidence, the higher the probability that the related point of interest will be exploited in the classification part. One common strategy is to visualize the trainable weights to interpret the decision-making of the convolutional neural network.

Weight Visualization as Leakage Detection. This method was introduced in [BPK92]

as a useful framework when dealing with spatial information. During the training process, the neural network evaluates influential neurons which can be helpful to address the classification task by attributing large weight values. In deep learning, this technique is usually used to evaluate the patterns extracted by the first layers of a deep architecture [START_REF] Hinton | Unsupervised discovery of nonlinear structure using contrastive backpropagation[END_REF][START_REF] Larochelle | Exploring strategies for training deep neural networks[END_REF][START_REF] Osindero | Modeling image patches with a directed hierarchy of markov random fields[END_REF][START_REF] Hinton | A fast learning algorithm for deep belief nets[END_REF]. Therefore, we propose to adapt the weight visualization tool in order to evaluate the feature selection part of a convolutional neural network. As defined in Subsection 4.2.2, the flatten operation characterizes the border between the feature selection part and the classification part of a convolutional neural network. Thus, visualizing the weights at the output of this operation is beneficial to assess the ability of the feature selection part to capture the expected points of interest. As remainder, the flatten operation concatenates each intermediate leakage trace following an axis in order to reduce the space dimension of the feature selection part to a 1-D space that fits with the classification part. By concatenating the output of the flatten layer following the columns (see Equation 4.9), we retain timing information to be able to interpret the neurons considered as relevant for the decision-making (see Figure 6.1a). Once the training process is performed, the neurons where the sensitive variable leaks will be evaluated with high weights if the feature selection part effectively extracts the points of interest. Thus, by visualizing the weight values of the flatten layer, the Evaluator can understand which neurons have a positive impact on the classification and hence, thanks to the feedforward propagation, we can interpret which time samples influence the most the model F Θ .

Let N [f +1] be the number of neurons in the layer following the flatten operation,

N [f -1] filt.
be the number of filters in the last convolutional blocks and dim(T [f -1] ) be the dimension associated with each intermediate leakage trace after the last pooling layer. Let Θ [f +1] be the weights corresponding to the layer indexed after the flatten operation such that Θ

[f +1] ∈ M dim(T [f -1] )×N [f -1] filt. ,N [f +1] (R). Let Θ ∈ M dim(T [f -1] ),N [f +1] (
R) be a matrix that enables visualization of the weights such that Θ[m], which is associated with the m th neuron of the layer following the flatten operation, can be computed as follows:

Θi [m] = 1 N [f -1] filt. (i+1)×N [f -1] filt. j=i×N [f -1] filt. Θ [f +1] j [m]
,

where i ∈ [0, dim(T [f -1] )]. Then, let Θ ∈ R dim(T [f -1]
) be a vector that enables visualization of the mean weight related to each neuron of the layer [f + 1] such that:

Θi = 1 N [f +1] N [f +1] m=0 Θi [m], (6.2) where i ∈ [0, dim(T [f -1] )].
In other words, we first reduce the dimension of Θ [f +1] so that it corresponds to the temporal space defined by dim(T [f -1] ). This reduction is obtained by averaging the weights related to the same time sample (see Figure 6.1b). Finally, to obtain a global overview of feature selection part, the Evaluator has to compute the average of the weights associated with each neuron in order to evaluate the confidence of the network in revealing the points of interest.

If the feature selection part retrieves a point of interest on a time sample i, the related weight will be higher than 0. Depending on its magnitude, the network will be more or less confident in its detection. If the network is extremely confident in the information included at i, the related weight will be high and the exploitation of the sensitive information will be easy. On the other

HeatMaps.

Introduced in [START_REF] Zeiler | Visualizing and understanding convolutional networks[END_REF], heatmaps (or feature maps) help to understand and interpret the role of each filter in a convolutional neural network. We apply this technique in the side-channel context as a new tool to interpret the impact of filters so that we can adapt the neural network according to how the time samples are selected.

Let us denote N

[l]

filt. the number of filters in the l th layer of the convolutional part, T [l] the input(s) associated with the l th convolutional block such that T [0] corresponds to the leakage trace T. Then, the convolution operation between T [l] and the N We denote H [l] the heatmap (or feature map) associated with the l th layer such that:

H [l] = 1 N [l] filt. N [l] filt. i=0 (T [l] W [l] Θ,i ),
where

W [l]
Θ,i is the i th filter of the l th layer of the feature selection part and it is composed by the Θ trainable parameters. Thanks to this visualization technique, we can assess which neurons are activated f by the filters of each convolutional layer and understand how the time samples are selected (see Figure 6.2). Indeed, the resulted convolution operation reflects the time samples that are considered as relevant during the classification task. The comparison of this heatmap with the SNR peaks is helpful to investigate the ability of the network to find the points of interest. This result will be verified in the experimental section (see Section 6.2).

The weight visualization and the heatmaps are two tools that help the Evaluator to explain and interpret the feature selection part more clearly. By using these techniques to understand the internal layers of a CNN, it is possible to define a method to build suitable neural network architectures in the presence of synchronization and desynchronization effect.

f In this manuscript, the term activation refers to the output of a convolutional operation.

The following section analyzes the effect of the most influencing model hyperparameters (i.e. the length of the filters, the pooling operation and the number of convolutional blocks) on the extraction of the points of interest.

Impact of Hyperparameters on the Leakage Detection

To illustrate and explain the effect of each hyperparameters as far as possible, we consider the Chipwhisperer dataset introduced in Section 3.6. [START_REF] Goodfellow | Deep Learning. Adaptive computation and machine learning[END_REF] such that these optimizer hyperparameters g have been selected from a finite set of values (see Table 6.1).

Our choices are motivated by the fact that they provide good results, in terms of classification, on our datasets. Indeed, using these hyperparameters lead to a faster convergence towards a constant guessing entropy of 1. Finally, to accelerate the learning phase, we pre-process the data such that all trace samples are standardized (unit variance, zero mean) and normalized between 0 and 1 [START_REF] Goodfellow | Deep Learning. Adaptive computation and machine learning[END_REF]. In this section, we only focus on the points of interest extraction made by the feature selection part and not on the performance of the selected model F Θ .

Remark 6.2.1. As defined in Subsection 4.3.2, the learning rate is one of the most challenging hyperparameters to tune because it influences the time needed to train an algorithm and monitors the risk of vanishing and exploding gradient. In this section, we configure the learning rate by using a technique called One Cycle Policy [ST17, Smi17, Smi18] that helps choose a suitable hyperparameter value. Surprisingly, using this policy means we can choose much higher learning rates and significantly reduce training time while preventing overfitting.

Length of Filters

In this section, we demonstrate that increasing the length of the filter causes entanglement and reduces the network confidence in the detection of the points of interest. Let W Θ ∈ R n be a filter of length n such that W Θ = {θ 0 , θ 1 , ..., θ n } is optimized for maximizing the detection of a set

(T W Θ )[i] = n j=0 T j + i - n 2 × W Θ [j] ,
such that,

T j + i - n 2 × W Θ [j] = θ j × T j + i -n 2 if (j + i -n 2 ) ∈ {l 0 , . . . , l u-1 }, otherwise. (6.3)
where ≈ 0 and θ j denotes the weight related to the index j (i.e. W Θ [j]). Denote T a leakage trace such that (T W Θ )[i] covers the u relevant time samples {l 0 , . . . , l u-1 } and (T W Θ )[i+m] covers less than u of those time samples. Because W Θ maximize the detection of the u PoIs, then, Consequently, when entanglement occurs the convolved samples share the same relevant information. Therefore, in our example, the PoI is spread over the two convolved samples. By increasing the size n of the filters, we increase the entanglement, consequently, more PoIs are shared between these convolved points. Thus, for a given filter W Θ ∈ R n , the point of interest is spread over 2n convolved samples. If the Evaluator wants to precisely define the temporal space where the points of interest occur, we recommend minimizing the length of the filters in order to reduce the risk of entanglement and ease the training phase. We illustrate this property by considering different scenarios on the ChipWhisperer dataset with a fixed neural network architecture h . To efficiently evaluate the impact of the length of the filter, we select a wide range of lengths (i.e. in {1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23, 25, 50, 75, 100}) and visualize the weights Θ to experimentally verify the previous claim. The shorter the length, the less the informative time samples are spread over the convolved traces. In addition, comparing the results provided by the SNR (see Figure 3.9b) with Figure 6.4 shows that the weight visualization succeeds in recovering the location of the points of interest. The number of samples is divided by 2 because of the pooling stride value (i.e. 2) that we used in the first convolutional block. Thus, the weight visualization is not directly linked with the temporal instants of a leakage trace T. However, as the weight visualization is introduced to complement the gradient visualization, it is mainly useful to evaluate the impact of the model hyperparameters. Through Figure 6.4, small filters locate information better because the related points of interest are not shared with a lot of convolved samples, while using larger filters causes entanglement and provide the detection of "global features". The latter exploitation could be difficult during the classification part because the same information is spread over the leakage trace and the informative weights are almost similar to the noisy convolved samples. Hence, the network can be less confident on the detection of the resulted PoI and the exploitation phase can be affected. Indeed, if the weight related to the PoI is 0, the classification part cannot extract the relevant information provided by this sample. Increasing the entanglement can cause a dramatic impact on the leakage retrieval. Thus, the resulted training time needed to reach the final performance could dramatically increase. Another approach consists in linking the length of the filters with the number of trainable parameters such that the more the number of weights, the longer the training time. By reducing the entanglement, we can accelerate the training process without significantly degrading the final performance as the points of interest are extracted (see Figure 6.4a). If the feature selection part can capture the dependence between the leakage trace and the sensitive information with small filters, increasing its length does not bring further useful information for resolving the classification task.

(T W Θ )[i] > (T W Θ )[i + m].
Limitations of small filter size. Questioned by Wouters et al. in [START_REF] Wouters | Revisiting a methodology for efficient cnn architectures in profiling attacks[END_REF], using small filters have some limitations related to the robustness i of the training phase. They suggest this observation based on the Receptive Field [LLUZ16, IFLF + 20] which is similar to the entanglement [ZBHV20]. Therefore, the concept of entanglement helps us to better understand in which context larger filters can provide more stability. Indeed, increasing the length of the filters spread the relevant information over multiple convoluted samples. Hence, multiple weights are linked to the same PoI. During the training phase, the resulted network could be less disrupted to retrieve the sensitive value because there are multiple ways to extract the point of interest. However, through Subsection 6.3.1, we will experimentally show that small filters seem not widely impacted by this issue.

Once the Evaluator sets his convolutional layer, he has to configure the pooling operations to consider in order to complete the construction on a convolutional block. The following section is focused on the impact of the common pooling operations on the points of interest detection.

Pooling Operations

Introduced in Subsection 4.2.2, the pooling layer aims at reducing the dimension of the output of the convolutional layer (i.e. convolved leakage trace) while preserving the relevant information extracted by the filters. However, depending on the pooling operation the Evaluator considers, some distinctions can be highlighted. In this section, we compare the two widely used pooling operations, namely average pooling and maxpooling, that we briefly introduced in Subsection 4.2.2.

Average pooling operation.

Let T [l] be the input of the l th convolutional block and W [l] Θ ∈ R n a filter related to the same convolutional block. Let ps [l] be the pooling stride related to the l th convolutional block. Assume that the j th convolved sample (T

[l] W [l] Θ )[j] covers u [l] 1 relevant information {l 0 , . . . , l u [l]
1 -1 } and includes the sample with the most of relevant information l * opt. on the targeted sensitive variable. The resulted ps [l] convolved samples are covered by the i th pooling sample AvgP ool(T [l]

W [l] Θ )[i] such that, AvgP ool [l] ( (T [l] W [l] Θ )))[i] = i+ps [l] j=i (T [l] W [l] Θ )[j]
ps [l] = 1 ps [l] i+ps [l] j=i n k=0

T [l] k + j - n 2 × W [l] Θ [k] ≈ 1 ps [l] i+ps [l] j=i       n k=0 (k+j-n 2 )∈{l 0 ,...,l u [l] 1 -1 } θ [l] k × T [l] k + j - n 2       . Because (k + j -n 2 ) ∈ {l 0 , . . . , l u [l] 1 -1 }, θ [l] k × T [l] [k + j -n 2 ] > 0 is true only for the u [l]
1 points of interest it covers (see Equation 6.3). Following the SELU function (see Equation 4.8), we can simplify our solution such that (x) = λ • x.

On the other hand, assume that the (i + m) th pooling sample AvgP ool(T [l]

W [l] Θ )[i + m] covers (u [l] 1 + u [l] 2 ) points of interest {l 0 , . . . , l u [l] 1 + l u [l] 2
-1} such that it also includes l * opt. . It this setting, we assume that its u Θ )[i]. Thus, from similar approach, we can observe that, AvgP ool [l]

( (T [l] W [l] Θ )))[i + m] ≈ λ ps [h] i+m+ps [l] j=i+m n k=0 (k+j-n 2 )∈{l 0 ,...,l u [l] 1 +l u [l] 2 -1} θ [l] k × T [l] k + j - n 2 .
As previously mentioned, θ

[l] k × T [l] [k + j -n 2 ] > 0 is true only for the (u

[l] 1 + u [l]
2 ) points of interest it covers (see Equation 6.3), i.e. when (k + j -n 2 ) ∈ {l 0 , . . . , l u-1 }. Therefore,

AvgP ool [l] ( (T [l] W [l] Θ )))[i + m] -AvgP ool [l] ( (T [l] W [l] Θ )))[i] = λ ps [h] i+m+ps [l] j=i+m n k=0 (k+j-n 2 )∈{l u [l] 1 ,...,l u [l] 1 +l u [l] 2 -1} θ [l] k × T [l] k + j - n 2 .
Therefore, using the average pooling operation preserves the unshared information when two consecutive overlapped pooling operation are performed which is beneficial to keep the maximum amount of information related to the targeted sensitive variable.

MaxPooling operation

In the case where the MaxPooling is used, then,

M axP ool [l] ( (T [l] W [l] Θ )))[i] = max j∈{i,...,i+ps [h] } (T [l] W [l] Θ )[j] = l * opt. ,
and,

M axP ool [l] ( (T [l] W [l] Θ )))[i + m] = max j∈{i+m,...,i+m+ps [h] } (T [l] W [l] Θ )[j] = l * opt. . Therefore, M axP ool [l] ( (T [l] W [l] Θ )))[i + m] -M axP ool [l] ( (T [l] W [l] Θ )))[i] = 0.
When MaxPooling is used, if two consecutive pooling computation share the same optimal leakage l * opt. , then this information is spread over the pooling samples. Furthermore, because l * opt. is the only sample selected, all other leakages are discarded. Thus, if the Evaluator considers the maxpooling operation, he can lose information that seems less important while it is essential for solving the classification task. For this reason, we recommend using average pooling as much as possible because no relevant points are discarded. This observation is in accordance with [START_REF] Wu | On the importance of pooling layer tuning for profiling side-channel analysis[END_REF] that experimentally evaluate the impact of the pooling hyperparameters in a wide range of scenarios. Therefore, we will only consider the average pooling operation in the rest of the manuscript.

Once the Evaluator selects the adequate pooling operation to design the feature selection part, he has to define the number of convolutional blocks j that constitutes the chosen convolutional neural network. The following section concludes our investigation by evaluating the impact of the number of convolutional blocks on the extractions of the points of interest.

Number of Convolutional Blocks

In this section, we provide an interpretation of the number of convolutional blocks. As shown in Subsection 6.2.2, using average pooling has the advantage that unshared information is preserved. However, when a large pooling stride is configured, the network confidence on the relevant information is reduced because the information is divided by pooling stride value after each convolutional block. Consequently, the related weights become similar to those of uninformative samples.

Furthermore, increasing the number of convolutional blocks reduces the trace dimension while preserving relevant information associated with the leakages. Indeed, in most cases, dim(T [l] ) = dim(T [l-1] ) ps [l-1] . Thus, for each additional convolutional block, the distance between the relevant points is reduced by a factor which depends on the pooling stride value. Consequently, if the Evaluator has to deal with a cryptographic module, in which hiding countermeasures are implemented, adding convolutional blocks is useful to reduce the desynchronization effect, and thus, retrieving the points of interest is eased. By adding more convolutional blocks, we can drastically reduce the impact of desynchronization by choosing an appropriate pooling stride ps [l] .

To illustrate this phenomenon, we visualize the weights Θ associated with four parametric models F Θ configured with different numbers of convolutional blocks. Indeed, to efficiently evaluate its impact, we select a wide range of numbers of the convolutional blocks (i.e. in {1, 2, 3, 4, 5}) to experimentally verify the previous claim. The shorter the number of convolutional blocks, the less the informative time samples are blurred. Each convolutional block is configured with one convolutional layer composed by two filters of size 1 and one average pooling layer with a pooling stride of 2 for each convolutional block. The parametric models are trained on the Chipwhisperer dataset and the obtained result are illustrated in Figure 6.5. As expected, the model with 1 convolutional block seems to be more confident in its detection as large weight values are assigned on the related points of interest. However, as we can see, the deeper the network, the less confident it is in its feature detection. In the presence of desynchronization, the Evaluator needs to find a trade-off between the detection of the desynchronization effect and the preservation of the maximum amount of information related to the points of interest.

Through this section, we validate our assumption which suggests that the feature selection part aims at extracting the points of interest from the leakage traces. Introduced as a complement of the gradient visualization, the weight visualization tool and the heatmaps have been defined to explain and interpret the impact of model hyperparameters that composed the feature selection part. Their application allows us to define some guidelines that the Evaluator can follow in order to design a convolutional neural network. Our observations can be summarized as follows:

• Length of the filters -As illustrated in Figure 6.4, smaller filters tend to identify local features, which is expected in side-channel context, while larger filters focus on global features. In addition, increasing the length of the filters spreads the relevant information over convolved samples. This phenomenon causes a larger training time as the weights related to informative samples converge towards those of uninformative samples. Thus, using fitlers with small length seem favourable from an attack perspective.

• Pooling operations -While the average pooling captures all the points of interest induce in a leakage trace, the maxpooling operation only keeps the time sample which provides the most of information regarding the targeted sensitive variable. Thus, considering the latter operation can be problematic from a performance perspective because some points of interest can be discarded which is an undesired situation. Hence, even if the average pooling is impacted by uninformative samples, we suggest the Evaluator to consider the it instead of the maxpooling in order to mitigate this issue.

• Number of convolutional blocks -Because of the pooling operations, increasing the number of convolutional block reduces the confidence of network in its ability to extract the sensitive information. However, thanks to the pooling stride value, adding convolutional block is beneficial to reduce the desynchronization effect. Thus, the Evaluator has to find a trade-off between the network confidence and the reduction of the desynchronization effect.

SUM UP... From the observations provided in this section, we propose a methodology for designing suitable feature selection part on a set of desynchronized leakage traces which implement a random delay effect. But first, we propose a solution when the Evaluator has to deal with a set of synchronized leakage traces.

Methodology for CNN Architectures

Application on Synchronized Traces

Methodology. According to the observations made in Subsection 6.2.3, adding convolutional blocks reduces the distance between the samples in order to ease the detection of the desynchronization effect. When the Evaluator wants to build a convolutional neural network such that leakage traces in the training, validation and test sets are synchronized, he does not need to configure more than one convolutional block. Indeed, using more than one convolutional block has two major drawbacks. First, in the case when the points of interest are temporally close to each other, adding convolutional blocks increases the risk of entanglement. As we showed in Subsection 6.2.1, entanglement can generate a spreading of relevant information through the convolved time samples and thus, reducing the network confidence (see Definition 6.1.3.1). Secondly, because of the pooling operation (see Subsection 6.2.2), some information can be lost: the same most relevant feature can be spread over the convolved samples (i.e. maxpooling) or each relevant information can be reduced following the pooling stride value (i.e. average pooling). Thus, when no desynchronization occurs, we recommend setting the number of convolutional blocks to 1 in order to ease the detection of the points of interest.

In [START_REF] Maghrebi | Breaking cryptographic implementations using deep learning techniques[END_REF] and [BPS + 20], the authors show that the fully-connected neural networks can be a good alternative when the Evaluator wants to build a suitable architecture for classifying a set of synchronized leakage traces. However, fully-connected neural networks are only composed of fully-connected layers. Thus, considering a convolutional neural network, which is viewed as a FCNN where each neuron of the layer l is linked with a reduced set of neurons of the layer l -1 [START_REF] Kleinsmith | CNNs from different viewpoints -prerequisite : Basic neural networks[END_REF], is beneficial in side-channel context as only a few samples are needed for decisionmaking. Using a CNN with short filter helps to focus its interest on local perturbations and dramatically reduces the complexity of the neural network. It is thus recommended to use CNNs with the shortest filters possible (i.e. , 1). In [WAGP20], Wouters et al. suggest that considering filters of size 1 perform an additional preprocessing to the leakage traces in order to enhance the points of interest extraction. Finally, the number of filters and the dense layers that compose the classification part should be managed depending on the device under test.

DPA contest-v4. DPA contest-v4 is the easiest dataset because we consider it without countermeasures, consequently the relevant information leaks a lot. Thus, it is straightforward for the network to extract sensitive variables. To generate the convolutional neural network, we consider only two filters of size 1 and compose the classification part with one dense layer of 2 nodes. Finally, we set our learning rate to 10 -3 . The network is trained for 50 epochs with a batch size of 50.

Visualization tools help evaluate the training process (see Figure 6.6). As explained in Subsection 6.1.3, visualization of the weights shows that the feature selection part is accurately set because the points of interest are correctly extracted. Indeed, comparing Figure 6.6b with the SNR computation (see Figure 3.10b) is helpful to verify this observation. Furthermore, by visualizing the gradient (see Figure 6.6c), we can consider that the classification part is also working accurately because the points of interest exploited at the end of the network are the same as those recognized by the feature selection part. Thus, no information is lost between the convolutional part and the end of the network. Then, we compare the resulted performance with [PHJ + 18] in which the authors published the best performance on DPA contest-v4 dataset using deep learning techniques. The results related to N t rank seem to be similar to those we obtain. However, when we compare the related network complexity, we observe a non-negligible improvement when our methodology is considered. Indeed, the complexity associated with our network is 6 times lower than the previous most powerful model. By reducing the complexity of the network, we achieve a remarkable reduction in training time (see Table 6.2).

AES_HD.

For the evaluation of this dataset, we design a convolutional neural network such that the number of filters is set to 2. Then, the classification part is configured with 1 dense layer of 2 neurons. Finally, we set the learning rate to 10 -3 . The training runs for 20 epochs with a batch size of 256. Looking at the Figure 6.7, we can conclude that our model is not optimized. Indeed, the weight visualization shows us that the selection of features is effective because our network can detect the relevant leakage points. When we look at the SNR computation (see Figure 3.11b), the sensitive information leaks between the time samples 950 and 1, 050 which corresponds to the features detected by the feature selection part. However, by visualizing the gradient, we observe that the overall neural network is not enabled to significantly recognize the points of interest (see Figure 6.7c). Thanks to these visualization techniques, we can identify which part of the network needs optimizing. Currently, no tool is available that allows interpretation of the classification part to improve its efficiency. However, even if the classification part is not powerful, our network still performs much better than the state-of-the-art. We compare our results with the architecture proposed in [KPH + 19] where they achieved the best performance on this dataset. On average, N t rank reaches 25, 000 traces. By applying our methodology, we dramatically improve this result. First, the new architecture has 31, 810 times fewer parameters. Now, only 31 seconds are necessary to train the network. Finally, our network outperforms the previous state-of-the art network by getting N t rank around 1, 050 (see Table 6.3) while, from Figure 6.7a, we observe that the best side-channel attack retrieves the secret key in less than 100 leakage traces.

ASCAD-v1 (synchronized traces).

To generate our convolutional neural network, we When we compare the new performances, we notice that our new network is 3, 930 times less complex than the original paper. In terms of performance, our simpler neural network achieves N t rank in 191 leakage traces in average while the best attack retrieves the secret key in less than 10 leakage traces. In comparison, the original neural network reaches the same performance only after 1, 146 traces (see Table 6.4). Through this section, we validate the benefits of our methodology on a wide range of scenarios when no hiding countermeasure is implemented. From the obtained results, we can suggest that the convolutional neural networks do not have to be complex in order to extract the secret key manipulated by the cryptographic module. However, this observation cannot be extended to large leakage traces as our work is applied only on very small leakage traces (i.e. less than 10, 000 time samples) where few sensitive variables leak (i.e. less than 10). But this scenario corresponds to a classical evaluation process where the Evaluator selects a small portion of a leakage trace where the targeted sensitive variable leaks.

In the following section, we propose another methodology that the Evaluator can consider in order to mitigate the random delay issue.

Random Delay Effect

As mentioned in Subsection 3.4.2, the random delay countermeasure significantly reduces the correlation between the targeted sensitive variable and the time samples where it leaks. The higher the amplitude of the random delay, the lesser the probability of observing the execution of a given cryptographic operation for a certain period of time. Thus, adding desynchronization effect does not reduce the information contained in a set of leakage traces, but, retrieving the secret is more challenging. In this section, we aim to find a methodology such that we design a Θ-parametric model F Θ to deal with random delay effect while the performance to solve the classification task is preserved.

Methodology.

To build a suitable neural network architecture, we suggest using a new methodology that helps the detection of desynchronization effect while reducing the dimension of the leakage traces so as to focus the neural network on the points of interest (see Figure 6.10). For a better understanding, we propose to apply the following methodology on a toy example. We simulate a set of 50, 000 leakage traces (45, 000 for the profiling phase, 5, 000 for the validation phase) such that we assume that each leakage trace is configured by 4, 000 time samples with 5 points of interest equally distributed the leakage trace. In addition, a random delay effect with a maximum amplitude of 100 is considered in order to assess our proposition. The simulated leakage model does not induce interactions between bits (i.e. G 1 ) such that all bits have the same weighting. Hence, the i th time sample of the simulated leakage trace T is defined as follows:

T[i] = 1 • Y [3] + 1 • Y [6] + Z[i] if i = 1, Z[i]
otherwise, (6.4)

where

Y [b] = Sbox[X ⊕ k * ][b]
denotes the b th bit of the output of the Sbox and Z[i] is a Gaussian noise following N (0, σ 2 ) such that σ 2 = 0.1. The related SNR computation is provided in Figure 6.9d. The methodology can be described as follows, such that the feature selection part can be divided into three blocks:

• As shown in Subsection 6.2.1, the first layer aims at minimizing the length of the filters in order to mimic the entanglement between each point of interest and extract the relevant Figure 6.9: Evaluation of the methodology on a simulation characterized in Equation 6.4.

information. Reducing the length of the filters helps the network to focus its interest of local perturbation and consequently, can get a precise characterization of the points of interest. We suggest setting the length of the filters in the first convolutional block, to 1 in order to optimize the entanglement minimization. This can also be explained as an automatic preprocessing phase where the neural network adjusts the leakage traces in order to enhance the classification task [START_REF] Wouters | Revisiting a methodology for efficient cnn architectures in profiling attacks[END_REF]. Then, the first pooling layer is set to ps [1] = 2 in order to reduce the dimension of the trace and help detect desynchronization. In order to confirm this claim, we compute the heatmap of the first convolutional block (see Figure 6.9a). Therefore, we are able to evaluate which neurons are activated through this convolution.

• The second block tries to detect the point of interest impacted by the random delay effect such that A RD be its maximum amplitude. By applying filter length of size A RD ps [1] , we focus the interest of the network on the detection of the desynchronization of each leakage trace. With this proposition, we are assured that the relevant pattern is included in the filter. Hence, the leakage will be necessarily extracted. The network obtains a global evaluation of the leakages by concentrating its detection on the leakage desynchronization and not on the leakages themselves. Then, to focus the information of a single sample, we set the pooling stride ps [2] to A RD ps [1] . This maximizes the reduction of the intermediate trace dimension while preserving the information related to the targeted sensitive variable. This process is illustrated in Figure 6.9b. Thanks to the heatmap, we evaluate that the SNR peaks are perfectly identified by the convolutional block. Indeed, by comparing the activity detected by the convolution operation with the SNRs peaks (see Figure 6.9d), we can argue that the features are correctly selected by the filters of the 2 nd convolutional block.

• The third block aims at reducing the dimensionality of each intermediate trace in order to focus the network on the relevant points and to remove any irrelevant ones. In the case where our leakage traces have u points of interest, then, only the u time samples help the network to make a decision. By dividing the output of the second convolutional block into u different parts, we force the neural network to only focus its interest on the PoIs. Indeed, each part contains information related to a single spread leakage. This process reduces the dimensionality of each intermediate trace by u such that each sample of the output of the 3 rd convolutional block characterizes a point of interest. Furthermore, applying this technique limits the desynchronization effect because we force the network to concentrate the initial desynchronized PoIs into a single sample. This property can be visualized in Figure 6.9c. In our simulation, we can identify u = 5 SNR peaks. In order to differentiate informative from uninformative convolved samples, we reduce the leakage trace dimension into 8 samples such that each of them contains the information related to the targeted sensitive variable.

Through Figure 6.9, the Evaluator can assess how a point of interest is spread through the feature selection part. Indeed, when he visualizes the heatmap after each convolutional block, he is able to evaluate the evolution of the dimension of the leakage trace as well as the related activation. Through the visualization of the heatmap of the 3 rd convolutional block (see Figure 6.9c), the Evaluator can define the amount of relevant information included in each portion of the leakage trace such that the sample at index 2 contains the information related to the portion of the leakage trace in [1, 000, 1, 500] (see Figure 6.9d). The other samples define the information related to the portion of the leakage trace. Thus, through the proposed feature selection part, we reduce the dimension of the leakage traces such that only the informative time samples are kept. This reduces the complexity of the neural network as well as the resulted training time which is beneficial from an evaluation perspective (see Subsection 6.1.1). An overview of this methodology is provided in Figure 6.10.

AES_RD.

Our new architecture can be set as shown in Figure 6.10. In the second convolutional block, the length of the filters and the pooling stride are configured following the value of the desynchronization effect (i.e. A RD ps [1] ). As A RD is nearly equal to 1, 000 [START_REF] Wouters | Revisiting a methodology for efficient cnn architectures in profiling attacks[END_REF], the length of the filters n [2] as well as the pooling stride ps [2] are set to 500. More details about these hyperparameters are provided in Table 6.8. Then, two fully-connected layers composed of 10 neurons define the classification part. Thanks to the one cycle policy, we are able to set our learning rate in the range 10 -4 ; 10 -3 . The network is trained for 50 epochs with a batch size of 50. When our methodology is applied, the impact of the desynchronization is dramatically reduced and the performance of the neural network is also less affected by this countermeasure. Through Figure 6.11, we observe the most efficient attack retrieves the secret key in 1 leakage trace while the worst case, with 10 leakage traces. Compared with the state-of-the-art [KPH + 19], the performance N t rank is similar but the complexity related to our network proposal is greatly reduced (7.35 times smaller). This reduction improves the training time by a non-negligible factor and consequently, ease the application of deep learning discriminative models in the evaluation process.

ASCAD-v1 with

A RD = 50. Thanks to Figure 6.8, we set u = 3 because three global leakage areas appear. As the previous paragraph, the hyperparameters are configured following Figure 6.10. In this dataset, the maximum amplitude of random delay equals 50. Thus, the length n [2] of the filters and the pooling stride ps [2] defined in the second convolutional block are configured to A RD ps [1] = 2. Thus, the neural network focuses its interest on the detection of the desynchronization effect. In order to preserve the information related to the points of interest, we set ps [3] to 4. This generates an output with 3 samples at the end of the feature selection part. More details about these hyperparameters are provided in Table 6.8. The best performance is obtained when we configure three fully-connected layers with 15 neurons. We apply a range of learning rate between [5 × 10 -4 ; 5 × 10 -3 ] and we set the number of epochs to 50 with a batch size 256. Applied on this dataset, our methodology outperforms the state of the art remarkably. In the original paper, Prouff et al. did not reach a constant guessing entropy of 1 with 5, 000 leakage traces [BPS + 20]. Applying our methodology, we converge, in average, towards a constant guessing entropy of 1 with 244 leakage traces (see Figure 6.12a) while the complexity of our networks is divided by 763. As a reminder, the performance related to the neural network trained with synchronized traces converges towards a guessing entropy of 1 with around 200 traces. Thus, we succeed in dramatically mitigating the random delay effect without impacting the network performance.

ASCAD-v1 with a Random delay:

A RD = 100. Finally, we apply our methodology on an even more complex system implementing a random delay with A RD = 100. As the previous paragraphs, we set our network with the hyperparameters detailed in Table 6.8. In the second convolutional block, we set the length of the filters and the pooling stride to 50 to focus the interest of the network on the desynchronization effect. In order to preserve the information related to the leakages, we set ps [3] to 2. This results in an output with 3 samples which is similar to ASCAD-v1 with a random delay of 50. Thanks to the one cycle policy, we define our learning rate in the range 10 -3 ; 10 -2 to allow a robust training and to reach a good local minimum. As before, our network is trained during 50 epochs with a batch size 256.

In comparison with [BPS + 20], our methodology generates a neural network that is far less complex and N t rank is outperformed. Indeed, we converge towards a constant guessing entropy of 1 with 270 leakage traces while the original paper couldn't converge with 5, 000 leakage traces (see Table 6.7). In addition, over 100 consecutive attacks, the Evaluator retrieves the secret key with less than 15 leakage traces in the best-case scenario (see Figure 6.12b). Furthermore, by reducing the network complexity, the training process can be performed much faster. Comparing this performance with Subsection 6.3.1, we note that our methodology dramatically reduce the impact of the desynchronization. Indeed, the performance of the two models is similar, thus, our methodology eliminates the effect of the random delay countermeasure.

T [2] u = 1 32 ASCAD-v1 (N [0 ] = 50) 1 st convolutional

Discussion on Discriminative Neural Networks in Side-Channel Analysis

Methodology's improvement. This methodology can be applied to implementations where random delay as well as Boolean masking are considered by the Developer. However, to construct the most efficient convolutional neural network, the fully-connected layers and the optimizer hyperparameters have to be adapted following the targeted implementation. Indeed, as observed through Subsection 6.3.1 and Subsection 6.3.2, the Evaluator has to monitor those hyperparameters in order to adequately solve the classification task. This aspect should be a part of a future work. Regarding the proposed methodology, some improvements can be brought. Indeed, as experimentally shown by Wouters et al. [START_REF] Wouters | Revisiting a methodology for efficient cnn architectures in profiling attacks[END_REF], the length of the filters can be reduced without altering the related model performance. However, no theoretical demonstration or guidelines have been provided to ease the construction of convolutional neural networks. Finally, the proposed neural network can be optimized with the related work proposed in deep learning based sidechannel context (see Subsection 4.4.2) or by finding the most suitable hyperparameters like the weight initialization technique [START_REF] Li | A comparison of weight initializers in deep learning-based side-channel analysis[END_REF] and the activation function [START_REF] Knezevic | Neurosca: Evolving activation functions for side-channel analysis[END_REF].

Network Complexity. Through Subsection 6.3.1 and Subsection 6.3.2, we demonstrate that the discriminative models applied in deep learning based side-channel context do not have to be complex to perform well on low leakage trace dimension. This observation has been then validated by the side-channel community on small [LKP20, WPP20, WAGP20, PP21, WWJ + 21, PWP21, RWPP21] and large leakage traces (i.e. D > 100, 000 time samples) [MBC + 20]. However, to defeat the random delay effect, we observe that the neural network complexity has to be increased. Thus, from the Evaluator point of view, performing a preprocessing phase that reduces the desynchronization effect can be beneficial from a network complexity perspective. In addition, if the Evaluator is confronted to a cryptographic module implementing hiding countermeasures, Zhou and Standaert suggest performing a preprocessing phase as it can be beneficial from an attack perspective [START_REF] Zhou | Deep learning mitigates but does not annihilate the need of aligned traces and a generalized ResNet model for sidechannel attacks[END_REF]. Finally, to assess the perfect suitability of discriminative model to perform side-channel attacks, the Evaluator can question its relevance regarding the performance of the generative approach introduced in Chapter 5.

Comparison with Generative models. When the discriminative approaches are considered, a major drawback can be highlighted regarding the architecture configuration (see Subsection 6.1.1). The more effort the Evaluator spends on the hyperparameter tuning of the network architecture, the more efficient the resulted attack is expected. Even if the proposed methodology tends to reduce this gap, it remains a major issue for the construction of a suitable neural network. In addition, due to their black-box property, the discriminative models are difficult to interpret. However, the main benefit of this approach is about automatically combining the point of interests in order to mitigate the data randomization countermeasure (e.g. the masking effect).

To compare both approaches, the following generative models are designed with respect to the conditional variational autoencoder proposed in Chapter 5. For being compliant with Subsection 5.4.1, we focus the interest of the generative models on the most relevant samples only, while the discriminative model considers all the samples of the leakage traces. Indeed, as highlighted in Subsection 5.3.3, increasing the number of irrelevant time samples highly impact the network complexity of the cVAE-ST and the training time without altering the related performance. While our work does not investigate the dimensionality reduction techniques for improving the generative model, we want to evaluate this new proposition in side-channel field. First, on Figure 6.13a, we can visualize the rank evolution of the generative and the discriminative models on the DPA contest-v4 dataset. While a discriminative model can retrieve the secret key with 4 leakage traces, a generative model reaches the same performance depending on the number N v of latent samples. As mentioned in Subsection 5.2.4, the value of N v depends on the ability of the conditional variational autoencoder to correctly approximate Pr[T|Y, φ]. The higher the N v , the more confident the resulted attack. This observation can be made in Figure 6.13a. Indeed, if N v = 1, two leakage traces are needed to retrieve the secret key. However, a poor rank stabilization is observed. To rectify this point, increasing the N v 's value preserves a constant rank convergence towards 1.

The same observation can be made when the AES_HD dataset is considered. Indeed, when the N v value increases, a rank stabilization is observed when the number of attack traces grows. In addition, Figure 6.13b highlights a better model when the generative approach is considered. Indeed, for N v = {100, 1000}, the resulted model converges towards a constant rank of 1 with 250 attack traces. Even if the discriminative approach directly estimates Pr[Y |T], this figure indicates a lower performance when classical deep learning based side-channel models are considered. Indeed, on average, the related amount of leakage traces that are needed for retrieving the secret key is about 1, 000. As illustrated by Ng and Jordan [START_REF] Ng | On discriminative vs. generative classifiers: A comparison of logistic regression and naive bayes[END_REF], this result suggests that a better discriminative model can be found on this dataset. This is in accordance with the claim provided in Subsection 6.3.1. Indeed, an optimal discriminative model should be, at least, as efficient as a generative approach k because it optimizes an approximation of the true unknown PDFs Pr [Y |T]. However, finding the best discriminative model can be difficult due to the broad hyperparameter selection. This result highlights the benefits of the cVAE-ST in comparison with the classical deep learning-based side-channel models from a practical perspective.

One benefit of the discriminative approach is to automatically recombine the point of interests.

In opposition, the generative approach does not take advantage of this property. Through Figure 6.13c, we can visualize the benefits of automatically combining the point of interest. Indeed, the discriminative approach converges faster towards a constant rank of 1. This result could be explained by the ability of the discriminative model to find a custom combining function that maximizes the posterior probabilities Pr[Y |T]. Hence, this custom unknown function can be more adapted for the targeted dataset. On the other hand, the cVAE-ST model is trained on combined leakage traces that are constructed from classical approaches (i.e. optimal product combining). Unfortunately, those combining functions are not fully adapted for all the targeted cryptographic modules. Consequently, when masking implementations are considered, a discriminative approach can provide better result than a generative approach.

These results highlight the benefits and the limitations of classical discriminative models against the cVAE-ST. While the configuration of cVAE-ST is simple in comparison with the discriminative models, the latter approach can perform, at least similarly, in all attack scenarios.

Conclusion

This chapter proposes a new methodology for designing convolutional neural networks that fits with the Evaluator's restrictions. To construct such proposition, we analyze the interpretability of convolutional neural networks by evaluating the impact of different model hyperparameters that compose the feature selection part. As the latter extracts the points of interest from the leakage traces, we ease its construction in order to enhance the model's performance. Thus, we introduce two visualization tools that help analyze which patterns are the most influential during the training process. These patterns are similar to points of interest which are well known in the side-channel context. We demonstrate the theoretical effect of the length of filters, the pooling operations and the number of convolutional blocks and we use these visualization techniques in order to check the validity of our demonstrations. These visualization tools help us find a method of generating an appropriate methodology with respect to the Evaluator's constraints, i.e. finding a good trade-off between leakage detection, network complexity and training time. Through the application of the methodology, we dramatically reduce the network complexity without altering the attack performance. This illustrates that the neural networks needed to perform side-channel attacks do not have to be complex.

Which solution should the Evaluator consider?

To conclude about Part II, the Evaluator can question the relevance of using the discriminative or the generative approach in sidechannel context. Both approaches (i.e. generative vs. discriminative) should be considered independently. However, depending on the Evaluator's objective, a solution can be preferred. Typically, if the Evaluator wants to build a neural network in order to get a first insight into how well a task can be solved, the construction of cVAE-ST seems natural as it provides a fully interpretable generative model. This approach can be helpful to evaluate the feasibility of an attack and get a security bound of a device. In addition, if the objective of the Evaluator is to deeply characterize the component behavior (i.e. leakage model), using such approach is beneficial from interpretability and explainability perspective. Furthermore, in [START_REF] Ng | On discriminative vs. generative classifiers: A comparison of logistic regression and naive bayes[END_REF], Ng and Jordan illustrate that a generative model can converge towards its minimal asymptotic error faster than a discriminative model. However, after a certain period of time, a discriminative approach converge towards a better solution and outperforms a generative classifier. While the Evaluator's goal is to converge towards the optimal Adversary (see Objective 3.3.1.1), the following part of this manuscript will be focused on the discriminative approach only as it provides the best performance result [START_REF] Ng | On discriminative vs. generative classifiers: A comparison of logistic regression and naive bayes[END_REF]. More precisely, Part III tackles the problem of optimal discriminative model by proposing new loss functions adapted from the optimal distinguisher detailed in Definition 3.3.1.4.

WHAT'S NEXT?

Part III

Towards a Better Optimization of the Discriminative Models in Deep

Learning Side-Channel Attacks 7.1 A Learning Metric Adapted for Side-Channel Analysis

Learning To Rank Approach

"Learning to Rank" refers to supervised machine learning techniques for training a model in solving a ranking task. While classical supervised learning tasks can be solved by classification or regression, the learning to rank approach requires other properties than regular classes or scores.

Definition 7.1.1.1 (Ranking task). Given a set of inputs I and a set of queries Q, the ranking task is characterized by the ability of the learning algorithm to automatically select F ∈ F that defines the relevance degree of each input in I given a query in Q.

In other words, a model that follows the learning to rank paradigm aims at sorting a list of inputs with respect to a given query such that inputs with a high degree of relevancy are ranked higher than inputs with a low degree of relevancy. Thus, it does not care about the exact classes or scores of each item and favors the relative order between each input. This task is useful for many applications in Natural Language Processing, Data Mining and Information Retrieval [Liu09, Bur10, Li11a, Li11b]. A typical example of inputs is characterized by a set of documents such that the ranking Θ-parametric model F Θ learns to sort this set with respect to q ∈ Q. The relevance of these documents is represented by several grades in a set S. The higher the grade, the more relevant is the document. To perform such approach, Tie-Yan Liu [START_REF] Liu | Learning to rank for information retrieval[END_REF] defines three strategies: the pointwise approach, the pairwise approach and the listwise approach.

Pointwise approach. Given a query q ∈ Q, a degree of relevancy has been specified for each input. Thus, the pointwise approach constructs a Θ-parametric scoring (or ranking) model F Θ : I × Q → S that predicts the relevance of an input for a given query. Once this prediction is made for each element of I, one can sort all the inputs in order to produce a final rank list. To solve this problem, the classification or the regression task can be considered. In the classification task, it is expected to assign similar inputs in the same class. Typically, this degree may be binary (e.g. S = {"irrelevant , "relevant } or S = {0, 1}) or may contain multiple classes (e.g. S = {"unsatisfactory , "satisfactory , "good , "excellent , "perfect } or S = {0, 1, 2, 3, 4}). On the other hand, the regression means giving similar continuous value to similar inputs, so that we can assign them identical preferences during the ranking procedure.

In side-channel context, the Evaluator's goal is to rank a set of hypothetical key K given a leakage trace T. Thus, the set of queries Q is defined by the set of leakage traces T while the set of inputs I, that has to be ranked, is characterized by K. While, in our context, the set S denotes the score associated with each hypothetical sensitive variable (Y k ) k∈K in Y, we can rewrite it as S ⊆ R |Y| . Consequently, the Θ-parametric model can be rewritten as F Θ : T → S such that it predicts the relevance of observing each hypothetical sensitive variable in Y given a leakage trace T. Indeed, the Evaluator can query F Θ to retrieve the score related to each hypothetical sensitive variable (Y k = f (X, k)) k∈K , with f : X × K → Y a cryptographic primitive (e.g. output of the Sbox, a XOR between a plaintext and a hypothetical key) which depends on a known plaintext X and a key hypothesis k ∈ K. As he knows the plaintext X and the related cryptographic primitive, the Evaluator is able to assign this set of scores to each key hypothesis in K, and therefore, sorting the list of key candidates from the most likely element to the less likely one. This entire process is similar to what the Evaluator does in the attack phase.

Pairwise approach. For a given pair of inputs, the model identifies the most relevant with respect to q ∈ Q. Thus, the pairwise approach constructs a Θ-parametric scoring model F Θ : I × I × Q → S that takes a pair of inputs and predicts which is the most relevant for a given query [BSR + 05, BRL07, WBSG10]. Once the model predicts the relative order for each pair of inputs (I × I), all the results can be embedded into a classical sorting algorithm (e.g. bubble sort, insertion sort) in order to provide a global ranking list. In this scenario, a classical example is to consider a binary classification problem such that given a pair of inputs (u, v) ∈ (I × I) the model assigns 1 (resp. -1) if u (resp. v) is more relevant than v (resp. u). We denote u v the event that u should be ranked higher than v. Thus, the set S = {-1, 1}.

In side-channel context, this approach suggests that the Evaluator considers a pair of sensitive variable in Y × Y as input a such that, given a leakage trace T, the Θ-parametric model is able to define the most likely solution. The comparison between each pair of hypothetical sensitive variable builds the ranking of the whole model. As previously mentioned, the set of scores S can be described as S ⊆ R |Y| . Thus, instead of evaluating a pair of inputs, the Evaluator can directly compare the score associated with each pair of classes in order to obtain a ranking list. This transposition is illustrated in Figure 7.1. This approach consists in predicting the score related to each hypothetical sensitive variable included in Y, and then, assigns it to the expected key hypothesis. The pairwise approach can be linked with the success rate metric considered in side-channel context. This result will be detailed in Subsection 7.1.2.

Listwise approach. It addresses the learning-to-rank problem in the most natural way, by taking a list of inputs and returning the ranked list for a given q ∈ Q [XL07, XLW + 08, PGH18, CHX + 19]. In comparison with the pointwise and the pairwise approaches, the listwise approach is quite complex to optimize. From a side-channel context, it is assumed that the Evaluator can predetermine the relevance of each hypothetical sensitive variable for a given leakage trace T. In this scenario, the Evaluator should be able to define a relative order between each irrelevant hypothetical sensitive variable. While his goal is only to differentiate the correct hypothetical sensitive variable from the irrelevant ones, this approach seems difficult to consider in practice.

Thus, contrary to the classical learning to rank approach that consists in the comparison between a The Evaluator can also consider a pair of key hypotheses in K × K as he knows the targeted cryptographic primitive f : X × K → Y and the manipulated plaintext X.

inputs' relevance, we propose to adapt the "Learning to Rank" approach for the side-channel context through the comparison of the score, related to each hypothetical sensitive information (Y k ) k∈K , with the other classes. Consequently, for a given input, this approach aims at penalizing the training process when the score related to the correct hypothetical sensitive variable Y k * is not considered as the most relevant. In the following sections, we demonstrate how the pairwise approach can be useful to optimize the rank of the secret key in comparison with the other hypothetical ones. The other learning to rank approaches are beyond the scope of this thesis.

Ranking loss Maximizes the Success Rate

Problem statement. During the certification process, the Evaluator wants to determine the optimal distinguisher (see Definition 3.3.1.4) so as to minimize the probability of errors or equivalently, maximize the probability of success of an attack [START_REF] Heuser | Good is not good enough[END_REF]. As mentioned in Subsection 3.3.4, this metric is characterized by the success rate of retrieving the secret key k * such that, given a set of N a attack leakage traces T a = {t 0 , . . . , t Na-1 }, it can be defined as follows:

SR o (F Θ , N a ) = Pr k∈K 1 s Na (F Θ ,k)≥s Na (F Θ ,k * ) ≤ o , ( 7.1)
where s Na (F Θ , k) denotes the score related to a key hypothesis k ∈ K. Thus, designing a loss function which automatically finds a Θ-parametric model that maximizes SR 1 (F Θ , N a ) can be beneficial from an evaluation perspective.

Pairwise approach and success rate approximation. As mentioned in Subsection 7.1.1, the pairwise approach aims at defining a relative order between a pair of inputs for a given query.

In the side-channel context, the pair of inputs is characterized by the score related to two key hypotheses (k, k ) ∈ K × K such that the score s Na (F Θ , k) should be higher than s Na (F Θ , k ) (i.e. s Na (F Θ , k) s Na (F Θ , k )). The corresponding loss function maps the scores associated with k and k and penalizes the training process once the relation s Na (F Θ , k) s Na (F Θ , k ) is not respected. This penalization is exactly what the Evaluator wants to optimize with the 1 st order success rate. Indeed, from Equation 7.1, the 1 st order success rate can be approximated through the computation of the probability that the score related to the secret key k * is higher than all key hypotheses. This means defining the probability that the secret key k * is ranked higher than all k ∈ K \ {k * }. Let a key hypothesis k ∈ K and a secret key k * , the probability that s Na (F Θ , k * ) s Na (F Θ , k) can be estimated via a sigmoid function [START_REF] Qin | A general approximation framework for direct optimization of information retrieval measures[END_REF][START_REF] Bruch | Revisiting approximate metric optimization in the age of deep neural networks[END_REF] such that:

Pr [s Na (F Θ , k * ) ≈ s Na (F Θ , k)] ≡ 1 1 + e -α(s Na (F Θ ,k * )-s Na (F Θ ,k)) , ( 7.2)
where α denotes the parameter of the sigmoid function. The value of α greatly impacts the training process. We evaluate its impact in Appendix B. In the following, we assume that α is well configured.

Definition of the ranking loss.

We apply the binary cross-entropy in order to penalize the deviation of the model probabilities from the desired prediction. In other words, we want to penalize the loss function when the expected relation s Na (F Θ , k * ) s Na (F Θ , k) is not observed. Thus, we define a partial loss function l(s Na (F Θ , k * ), s Na (F Θ , k)), for a given hypothesis k ∈ K, as:

l(s Na (F Θ , k * ), s Na (F Θ , k)) = -P k * ,k • log 2 Pk * ,k -(1 -P k * ,k ) • log 2 1 -Pk * ,k , (7.3)
where Pk * ,k = Pr [s Na (F Θ , k * ) s Na (F Θ , k)] and P k * ,k defines the true unknown probability that k * is ranked higher than k.

In the rest of the manuscript, we assume that the ranking value is deterministically known during the learning process, such that,

P k * ,k = 1 2 (1 + rel k * ,k ) [BSR + 05]
where rel k * ,k ∈ {-1, 0, 1} defines the relation between the secret key k * and k such that

rel k * ,k = -1 if k * is less relevant than k; rel k * ,k = 0 if k * is as relevant as k; rel k * ,k = 1 if k * is
more relevant than k. We assume that rel k * ,k is always equal to 1. In the side-channel context, this approximation is reliable because the Evaluator wants to maximize the score related to k * compared with the other hypotheses. From Equation 7.2 and Equation 7.3, we can deduce the following partial loss function:

l(s Na (F Θ , k * ), s Na (F Θ , k)) = log 2 1 + e -α(s Na (F Θ ,k * )-s Na (F Θ ,k)) , (7.4) with F Θ : T → S such that the score b S ⊆ R |Y| and s Na (F Θ , k * ) = Na i=0 F Θ (t i )[f (x i , k)
] denotes the score captured by the parametric model and f : X × K → Y is the targeted cryptographic primitive. Thus, Equation 7.4 gives us an insight into how the cost function penalizes the training process when the relation s Na (F Θ , k * ) s Na (F Θ , k) is not the expected result. Therefore, maximizing the success rate tends to minimize the ranking error between the secret key k * and a hypothesis k ∈ K. As a remainder, this cost function, presented in Equation 7.4, is only applied on a single key hypothesis. In order to efficiently find the model that minimizes the ranking error, we have to apply this cost function on each key hypothesis in order to maximize the rank of the secret key. Definition 7.1.2.1 (Empirical risk combined with ranking loss). Given a profiling set I p of N p pairs (t i , y i ) 0≤i≤Np , a Θ-parametric model F Θ and a number of attack traces N a such that N a |N p , we define the empirical risk combined with the ranking loss (RkL) function as:

R(L RkL , F Θ ) = N a N p Np/Na i=1 k∈K k =k * log 2 1 + e -α(s Na,i (F Θ ,k * )-s Na,i (F Θ ,k)) , (7.5)
where

s Na,i (F Θ , k) = Na j=1 F Θ t j+Na•(i-1) [f (x j , k)]
defines the score c of the hypothesis k ∈ |K| for given plaintexts (x j ) 1≤j≤Na while α denotes one hyperparameter d related to the sigmoid that is needed for estimating the success rate.

Remark 7.1.2.1. To discriminate the right sensitive variable and normalize the score vector to a probability distribution over Y, the softmax function is computed during the attack phase. This is essential to perform a side-channel attack (see Subsection 3.3.4).

With the ranking loss, we are more concerned with the relative order of the relevance of the key hypothesis than its absolute value (e.g. negative log-likelihood). Consequently, maximizing the success rate is equivalent to minimizing the ranking error for each pair (k * , k) k∈K . Furthermore, contrary to the classical negative log-likelihood, Definition 7.1.2.1 takes into account the number of attack traces that is needed to perform a successful side-channel attack. Thus, the ranking loss penalizes the learning process depending on the number N a of scores that the Evaluator aggregates before iterating the training process. Intuitively, this loss function is beneficial to select the model in F which minimizes the error provided on the success rate. This statement will be verified in the following section. As the ranking loss is linked with the success rate metric, visualizing the b Here, the score S denotes the value before the softmax function (see Figure 7.1). This choice is made to impact the training process accordingly to the relative order of the key hypotheses' relevance instead of the normalized probability distribution. However, the classical side-channel score (see Equation 3.5) can also be applied.

c If the normalized probability distribution is considered as the score S, therefore,

s Na,i (F Θ , k) = Na j=1 log(F Θ t j+Na•(i-1) [f (x j , k)]). d
The coefficient α can be specific for each k ∈ K. The resulted (α k ) k∈K can be useful to mitigate the imbalanced data representation by assigning higher weights to classes with smaller occurrences. evolution of the related empirical risk during the training process gives an overview of how well the related attack on N a leakage traces should perform.

Remark 7.1.2.2. In classic information retrieval tasks, (i 0 , i 1 ) and (i 0 , i 1 ) characterize two different pairs of inputs such that the following relation holds i 0 i 1 i 0 i 1 . For each pair of inputs, if the difference of their scores is equal, thus, the empirical risk is the same regardless of their relative order. Indeed, in this configuration, swapping the rank of i 0 (resp. i 1 ) and i 0 (resp. i 1 ) does not impact the empirical risk R(L RkL , F Θ ) because it only cares about the total number of pairwise-rankings it gets wrong. This can be particularly problematic if we are interested in the top-ranking items. To solve this issue, the pairwise approach's literature applies some information retrieval measures (e.g. Discounted Cumulative Gain [START_REF] Järvelin | Cumulated gain-based evaluation of ir techniques[END_REF], Normalized Discounted Cumulative Gain [START_REF] Järvelin | Ir evaluation methods for retrieving highly relevant documents[END_REF], Expected Reciprocal Rank [START_REF] Chapelle | Expected reciprocal rank for graded relevance[END_REF], Mean Average Precision, etc) to compute the empirical risk. However, in our context, i 0 = i 0 , therefore the difference between the scores of each pair (i 0 , i 1 ) and (i 0 , i 1 ) gives us enough information on the position of i 0 related to i 1 and i 1 . Consequently, the addition of IR metrics is not relevant. Moreover, information retrieval metrics can be either discontinuous or flat, so gradient descent appears to be problematic (i.e. gradient equals to 0 or not defined) unless some appropriate approximations are used.

To emphasize the link with the side-channel context, the following section shows that the ranking loss is an upper bound of the measure-based ranking error.

Theoretical Bounds of the Ranking Loss

In the learning to rank research area, the information retrieval measures are used to evaluate the network performance. In most cases, two categories of metrics can be used: those designed for binary relevance levels (e.g. mean average precision, mean reciprocal rank [START_REF] Craswell | Mean Reciprocal Rank[END_REF]) and those designed for multiple levels of relevance (e.g. discounted cumulative gain, normalized discounted cumulative gain [START_REF] Järvelin | Ir evaluation methods for retrieving highly relevant documents[END_REF]). In the side-channel context, there are only two levels of relevance such that 1 is associated with the sensitive information Y related to the secret key k * and 0 otherwise. Thus, the metrics for binary relevance levels have to be considered.

Mean average precision and success rate. The mean average precision (MAP) defines

the average precision of the secret key k * over the |K| hypotheses. Let g Na = g 1 Na , g 2 Na , . . . , g |K| Na be a vector that defines the rank for each key hypothesis in K as introduced in Subsection 3.3.4. We consider g 1 Na as the most likely candidate and g |K| Na as the least likely one. Let d be a threshold and M AP @d be the average precision of the secret key k * in the top d relevant position of g Na such that:

M AP @d = 1 N q Nq q=1 AP q @d,
where N q denotes the number of queries and AP q @d is the average precision of the query q over the top i relevant position of g Na . As the only query considered in the side-channel context concerns the position of the secret key k * over g Na , M AP @d can be reduced to the computation of AP k * @d such that:

AP k * @d = 1 Number of True Positives at d d i=1 Number of True Positive seen × rel(i) i ,
where rel(i) is an indicator that equals 1 if the element at the i th rank is the secret key k * and 0 otherwise. As k * is assigned to a single position in g Na , the total number of True Positives equals 1 and the previous equation can be simplified as below:

M AP @d = AP k * @d = d j=1 1 g Na (F Θ ,k * )=j j ,
where g Na (F Θ , k * ) denotes the position of k * in g Na such that the sorted vector has been constructed from the Θ-parametric model F Θ (see Equation 3.6). Therefore,

M AP @1 = AP k * @1 = 1 g Na (F Θ ,k * )=1 = SR 1 (F Θ , N a ).
Thus, M AP @1 can be seen as a 1 st order success rate.

Lower bound of the ranking loss. As mentioned in [CLL + 09a], the standard pairwise loss is considered as the upper bound of the measure-based ranking error that is defined by 1 -M AP @|K| (justifications are provided in Appendix C).

Theorem 7.1.3.1 ([CLL + 09a]). Given a 2-level rating data with n 1 elements having grade 1 and n 1 > 0, then, the following inequality holds,

1 -M AP @|K| ≤ 1 n 1 |K|-1 i=0 |K|-1 j=0 gr(j)<gr(i) log 2 1 + e -α(s Na (F Θ ,i)-s Na (F Θ ,j)) , (7.6)
where gr(i) defines the grade associated to the i th key hypothesis ( i.e. 0 or 1).

In our context, a 2-level rating data means that the grade related to k is in {0, 1} such that it equals 1 if and only if k = k * . Thus, Theorem 7.1.3.1 can be easily written following the ranking loss.

Proposition 7.1.3.1. Given a 2-level rating data with n 1 elements having grade 1 and n 1 > 0, a set of N a leakage traces (t i ) 0≤i≤Na , and a Θ-parametric model F Θ , the following inequality holds:

1 -SR 1 (F Θ , N a ) ≤ 1 n 1 k∈K k =k * log 2 1 + e -α(s Na (F Θ ,k * )-s Na (F Θ ,k)) , ( 7.7
)

where s Na (F Θ , k) = Na i=1 F Θ (t i ) [f (x j , k)]
defines the output score of the hypothesis k ∈ |K| for given plaintexts (x j ) 1≤j≤Na

Proof. Following [CLL + 09a, Theorem 2] and [CLL + 09b, Lemma 1], given a 2-level rating data, it can be proved that:

n 1 -i 0 + 1 ≤ 1 n 1 |K|-1 i=0 |K|-1 j=0 gr(j)<gr(i) log 2 1 + e -α(s Na (F Θ ,i)-s Na (F Θ ,j)) ,
where n 1 denotes the number of elements having grade 1 and i 0 defines the position of the first element with grade 0 in a ranking list. If i 0 > n 1 , the first element with grade 0 is ranked after position n 1 . In side-channel analysis, there is only one candidate with a grade 1 (i.e. k * ). Hence, the correct candidate is ranked at the first position and 1 -SR 1 (F Θ , N a ) = 0. Similarly, the first element with a label 0 is ranked at the second position and n 1 -i 0 + 1 = 0. If i 0 ≤ n 1 , the first element with grade 0 is ranked before the secret key k * . Consequently, the correct candidate is ranked at the second position and 1 -SR 1 (F Θ , N a ) = 1. Similarly, the first element with a grade 0 is ranked at the first position and n 1 -i 0 + 1 = 1. Thus,

n 1 -i 0 + 1 = 1 -SR 1 (F Θ , N a ) ≤ 1 n 1 |K|-1 i=0 |K|-1 j=0 gr(j)<gr(i) log 2 1 + e -α(s Na (F Θ ,i)-s Na (F Θ ,j)) .
Finally, we can easily rewrite the right part of the inequality as:

|K|-1 i=0 |K|-1 j=0 gr(j)<gr(i) log 2 1 + e -α(s Na (F Θ ,i)-s Na (F Θ ,j)) = k∈K k =k * log 2 1 + e -α(s Na (F Θ ,k * )-s Na (F Θ ,k)) .
Indeed, the condition gr(j) < gr(i) holds for all j ∈ K \ {k * } if and only if i corresponds to k * . This result implies:

1 -SR 1 (F Θ , N a ) ≤ 1 n 1 k∈K k =k * log 2 1 + e -α(s Na (F Θ ,k * )-s Na (F Θ ,k)) .
From Proposition 7.1.3.1, we can deduce that minimizing the ranking loss is useful to find a model that maximizes the 1 st order success rate. Therefore, the value of the related empirical risk gives to the Evaluator an insight into how well F Θ performs related to the success rate. Thus, the ranking loss fits with the performance measure classically considered during the evaluation process.

Finally, to fully understand the role of the ranking loss, we investigate the impact of the empirical risk minimization on the trainable parameters.

Impact of the Ranking Loss during the Training Process

This subsection theoretically explains how the training process can be useful in order to precisely order the secret key k * amongst all the hypotheses.

The training process aims at minimizing the empirical risk R in order to reduce the error induced by F Θ (see Equation 4.3). As explained in Chapter 4, this process can be decomposed into two phases: the forward propagation and the backward propagation. As remainder, the goal of the forward propagation is to feed training examples to the Θ-parametric model F Θ in the forward direction by processing successive linear and non-linear transformations in order to predict a distribution over Y associated with a given leakage trace T. Once this process is done, the backward propagation measures the gap between the predictions and the expected output and reduces this error by updating the trainable parameters Θ that compose the neural network.

To optimize the parameters Θ, the gradient descent algorithm, or its derivative (e.g. stochastic gradient descent), is employed (see Subsection 4.3.1). Let Θ

[l] (i) ∈ Θ be the trainable parameters indexed at the l th layer such that, the (i+1) th iteration of the stochastic gradient descent algorithm can be defined as below:

Θ [l] (i+1) = Θ [l] (i) -η • ∇ Θ [l] (i) R(L RkL , F Θ (i) (T)) = Θ [l] (i) -η • k∈K k =k * ∇ Θ [l] (i) s Na (F Θ (i) , k * ) ∂ R(L RkL , F Θ (i) (T)) ∂s Na (F Θ (i) , k * ) +∇ Θ [l] (i) s Na (F Θ (i) , k) ∂ R(L RkL , F Θ (i) (T)) ∂s Na (F Θ (i) , k) , ( 7.8)
where η denotes the learning rate. From Equation 7.4 and Equation 7.8, we can deduce the following equation,

∇ Θ [l] (i) R(L RkL , F Θ (i) (T)) = -α k∈K k =k *    1 1 + e α s Na (F Θ (i) ,k * )-s Na (F Θ (i) ,k)    ∇ Θ [l] (i) s Na (F Θ (i) , k * ) -∇ Θ [l] (i) s Na (F Θ (i) , k) . (7.9)
This derivative can be decomposed in two parts. First, computing the gradient of the empirical risk combined with the ranking loss is equivalent to computing an ascent gradient of the score s Na (F Θ , k * ) and a gradient descent of s Na (F Θ , k). As mentioned in Subsection 7.1.2, the score value is defined by the prediction before the softmax function. The training process updates the weights to increase the score related to the secret key and reduces the score related to all the hypotheses k ∈ K\{k * }. Secondly, the norm of the gradient vectors is scaled by γ α (s

Na (F Θ , k * ), s Na (F Θ , k)) = α 1+e α(s Na (F Θ ,k * )-s Na (F Θ ,k))
. Depending on the difference between s Na (F Θ , k * ) and s Na (F Θ , k), the resulted norm varies as below:

• If s Na (F Θ , k) s Na (F Θ , k * ), γ α (s Na (F Θ , k * ), s Na (F Θ , k
)) tends to converge towards α, thus the norm of the gradient vector related to each score is maximized.

• If s Na (F Θ , k) = s Na (F Θ , k * ), γ α (s Na (F Θ , k * ), s Na (F Θ , k)) tends to converge towards α
2 , thus the norm of the gradient vector related to each score is divided by 2.

• If s Na (F Θ , k) s Na (F Θ , k * ), γ α (s Na (F Θ , k * ), s Na (F Θ , k))
tends to converge towards 0, thus the norm of the gradient vector related to each score is minimized.

Therefore, the ranking loss proposed in Equation 7.5 pushes the score of the secret key up and pushes the score of the key hypotheses down via gradient ascent/descent on a pair of items. This is equivalent to maximizing the success rate. For each pair (k * , k) k∈K , there are two "forces" at play. The force that each pair exerts is proportionate to the difference of their scores multiplied with α. Consequently, α should be carefully configured during the training process. The force applied on the secret key k * is equal to the sum of the forces exerted on each pair. Consequently, using the ranking loss tends to order the secret key as the highest position which is equivalent to maximizing the success rate.

Adapted from the "Learning to Rank" approach, the ranking loss penalizes the training process depending on the distance between the scores related to the secret key and the other key hypotheses included in K \ {k * }. To the minimization of the empirical risk combined with the ranking loss, the Evaluator wants to select a Θ-parametric function F Θ that maximizes the 1 st order success rate given N a attack leakage traces. Thus, the ranking loss is directly correlated with the performance metric classically considered by the Evaluator to assess the robustness of a cryptographic module against side-channel attacks. It notably allows to reduce the black-box issue of the discriminative approach in deep learning based side-channel context. SUM UP... However, the Evaluator can question the suitability of the ranking loss with respect to the negative log-likelihood from a performance perspective. The next section proposes to highlight the benefits of the ranking loss from an information-theoretic purpose.

Analysis of Optimal Model

An Approximation of the Optimal Distinguisher

In [START_REF] Eloi De Chérisey | Best information is most successful[END_REF], de Chérisey et al. link the probability of success of an attack, denoted P s , given a distinguisher F and the mutual information between a leakage trace T and a sensitive targeted variable

Y ∈ F n 2 given a plaintext X ∈ F n 2 , denoted M I(T; Y |X).
Theorem 7.2.1.1. [dCGRP19, Theorem 1] The following inequality is always true for any distinguishing rule:

H(K) -(1 -P s ) log 2 (2 n -1) -H 2 (P s ) ≤ N a • M I(T; Y |X),
where P s = Pr[ k∈K 1 s Na (F,k)>s Na (F,k * ) = 0] and H 2 (P s ) denotes the binary entropy of the probability of success of an attack.

This inequality suggests that no attack can succeed to retrieve the secret key within g(Ps) M I(T;Y |X) attack leakage traces, with g(P s ) = H(K) -(1 -P s ) log 2 (2 n -1) -H 2 (P s ). Following the work provided by de Chérisey [Che18, Section 3.2.2], we can notice that (1-P s ) log 2 (2 n -1)+H 2 (P s ) ≥ H(K| K). Consequently, minimizing (1 -P s ) log 2 (2 n -1) + H 2 (P s ) (or equivalently, maximizing P s ) is beneficial to converge H(K| K) towards 0. Therefore, finding a distinguisher that maximizes the success rate can be beneficial to reduce the uncertainty on K. By reducing this uncertainty for a given number N a of attack traces, we intuitively ease the ability of the Evaluator to recover the secret key. In other words, finding a distinguisher that maximizes the success rate can be beneficial to reduce the related number of attack traces. Through the consideration of the ranking loss, the Evaluator wants to generate such a model. More importantly, a model that maximizes the success rate can be linked with the optimal distinguisher. Indeed, following Objective 3.3.1.1 and Definition 3.3.1.4, a distinguisher F : T → P (Y) is defined as optimal if, for any dataset set of N a leakage traces T = {t 0 , . . . , t Na-1 }, the attack, that considers (F (t i )) 0≤i<Na , maximizes the success rate. As, in this chapter, the Θ-parametric ranking model F Θ : T → S, such that S ⊆ R |Y| , does not output a normalized probability distribution e , the Evaluator has to apply a softmax function on the output scores in order to get an approximation of the true unknown Pr[Y |T]. This approximation is denoted by Pr[Y |T, Θ]. Once the related model finds the trainable parameters Θ, the Evaluator can apply the distinguisher rule with respect to the log-likelihood distinguisher (see Definition 3.3.3.4) in order to extract the secret key that has been manipulated by the cryptographic module.

Definition 7.2.1.1 (Approximation of the Optimal Distinguisher). Given a set I a of N a leakage traces and a Θ-parametric conditional probability distribution of observing a sensitive cryptographic primitive Y following a leakage T denoted as Pr[Y |T, Θ], we define the approximation of the optimal distinguisher as:

D Θ (I a , k) = max Θ Na-1 i=0 log (Pr [Y = f (x i , k) |T = t i , Θ]) (7.10) = min Θ Na-1 i=0 log (1 -Pr [Y = f (x i , k) |T = t i , Θ]) ,
where f (X, k) = Y is the sensitive information computed from a cryptographic primitive f :

X × K → Y, a plaintext X, a key k ∈ K.
Once the approximation optimal distinguisher is performed, the Evaluator has to design the related decision rule such that:

k = arg min k∈K min Θ Na-1 i=0 log (1 -Pr [Y = f (x i , k) |T = t i , Θ]) ,
such that the attack process is considered as a success if k = k * . When the empirical risk combined with the ranking loss is considered, the training process optimizes the Θ trainable parameters in order to maximize the score of the secret key s Na (F Θ , k * ) amongst each key hypothesis k ∈ K \ k * for a given number N a of attack leakage. Thus, a ranking model F Θ : T → S, such that S ⊆ R |Y| , considering the ranking loss and the softmax function, that normalizes the output score vector to a probability distribution over Y, during the attack phase is beneficial to fit with Definition 7.2.1.1. Furthermore, through Equation 7.10, we can observe that minimizing the error on the success rate is helpful to estimate the optimal distinguisher defined in Definition 3.3.1.4. To converge towards the true distinguisher, some optimization algorithms (e.g. the gradient-based algorithms, Subsection 4.3.1) shall be run in order to minimize the error on Pr [Y |T, Θ] and find a local or a global minimum. When Θ is optimal, finding a model F Θ that minimizes the error on the success rate is equivalent to generating a distinguisher (D Θ (I a , k)) k∈K that converges towards the true (D (I a , k)) k∈K . Through Definition 2.5.2, we can assume that minimizing the error on the success rate is equivalent to optimizing an estimation of a mutual information between the sensitive information and the leakage trace. Indeed, given a profiling set I p of N p pairs (t i , y i ) 0≤i≤Np , a Θ-parametric ranking model F Θ and a number of attack traces N a such that N a |N p , the following inequality holds:

H (Y ) + y∈Y Pr [Y = y] N a N p Np/Na i=1 max Θ   Na-1 j=0 log 2 Pr Y = y|t j+Na•(i-1) , Θ   ≤ H (Y ) + y∈Y Pr [Y = y] t∈T Pr [T = t|y] log 2 (Pr [Y = y|t]) = M I (Y ; T) . (7.11)
Hence, following Theorem 7.2.1.1, finding a ranking model F Θ that maximizes the success rate aims at simultaneously minimizing an approximation of g(P s ) while maximizing an approximation of M I(T; Y |X). As mentioned in [DFS15, BHM + 19], a higher mutual information implies a more powerful maximum likelihood attack where the secret key k * can be extracted more efficiently. In other words, the ranking model F Θ optimizes the number of attack leakage traces that are needed to retrieve the secret key manipulated by the cryptographic module. Thus, from an evaluation perspective, the ranking loss can be highly beneficial.

In contrast, the Evaluator can question the interest of this approach with respect to the negative log-likelihood loss function combined with the softmax function.

The Negative Log-Likelihood as a Lower Bound of the Ranking Loss

Recall on the negative log-likelihood minimization. In deep learning based sidechannel context, a classical model F Θ,N LL : T → P(Y) is selected from the minimization of the empirical risk combined with the negative log-likelihood loss function. To solve the related classification task, the Θ-parametric model F Θ,N LL uses the softmax activation function to learn a probability distribution over |Y| labels conditioned on a leakage trace T. Indeed, given a set of N p labeled leakage traces I p = {(t 0 , y 0 ), (t 1 , y 1 ), . . . , (t Np-1 , y Np-1 )}, and a parametric model F Θ estimating the true unknown Pr [Y |T], the empirical risk combined with the negative log-likelihood loss function can be expressed as:

R(L N LL , F Θ,N LL ) = - 1 N p Np-1 i=0 log 2 e s1,i(F Θ,N LL ,k * )
k∈K e s1,i(F Θ,N LL ,k) , (7.12)

where s 1,i (F Θ,N LL , k) denotes the score related to the key hypothesis k ∈ K such that a leakage trace (t i ) 0≤i<Np is considered as input. Here, the score defines the value before the softmax activation function.

Since the loss function is minimized by gradient descent based algorithms (e.g. stochastic gradient descent, mini-batch gradient descent), the related derivative can be easily calculated as follows:

∂L N LL (F Θ,N LL , k * ) ∂s 1 (F Θ , j) =              1 - e s1(F Θ,N LL ,j) k∈K e s1(F Θ,N LL ,k) if j = k * , - e s1(F Θ,N LL ,j) k∈K e s1(F Θ,N LL ,k) if j = k * .
(7.13) Thus, applying the negative log-likelihood loss function on a Θ-parametric model that considers the softmax to approximate a probability distribution is helpful to penalize the trainable parameters linked to each output class. However, contrary to the ranking loss that penalizes the training process with respect to the relative order of each pair (k, k * ) k∈K , the negative log-likelihood with the softmax function considers the absolute value of each score. Thus, in side-channel context, the latter loss function can provide different sources of errors.

Difference on the penalization process. Comparing Equation 7.9 to Equation 7.13 gives to the Evaluator an insight into how each approach impacts the trainable parameters Θ. Typically, two scenarios can be observed:

• If j = k * , ∂L N LL (F Θ,N LL ,k * ) ∂s1(F Θ,N LL ,j)
penalizes the training process with respect to the probability related to the j th class. Thus, it does not reflect its relative order with the targeted output. In opposition, for α = 1, the derivative of the ranking loss defined in Equation 7.9 can be rewritten as follows:

- ∂L RkL (F Θ , k * ) ∂s Na (F Θ , j) = - e s Na (F Θ ,j) k∈{j,k * } e s Na (F Θ ,k) . (7.14)
This penalization term is very similar to Equation 7.13. However a non-negligible distinction can be made. While the ranking loss penalizes the trainable parameters of the j th class with respect to the distance between its score and the one related to the correct output, the negative log-likelihood loss updates its trainable parameters with respect to all key hypotheses in K. Thus, the penalization term applied on the j th class can be overlooked if the score s 1 (F Θ,N LL , j) s 1 (F Θ,N LL , i) such that i ∈ K \ {j, k * }. Thus, even if the relative order between s 1 (F Θ,N LL , j) and s 1 (F Θ,N LL , k * ) is non-negligible, it will not be taken into account during the training process. Hence, for a given iteration, the gradient descentbased algorithms can only penalize a limited number of output classes if a large difference is observed between their related scores. This result does not reflect what the Evaluator wants to optimize and a blurred parametric model can be obtained. In opposition, the ranking loss is not impacted by this scenario as it does not consider irrelevant classes for updating the trainable parameters of a given class.

• If j = k * , ∂L N LL (F Θ,N LL ,k * ) ∂s1(F Θ,N LL ,j)
penalizes the training process with respect to the probability error induced in the class k * . Thus, it reflects the impact of each score (s 1 (F Θ,N LL , k)) k∈K\{k * } on s 1 (F Θ,N LL , k * ) which is beneficial from a success rate approximation perspective. On the other hand, the derivative of the ranking loss is defined by the sum over K \ {k * } of the inverse of Equation 7.14. As mentioned in Subsection 7.1.4, the latter solution opposes two "forces" for each pair (k * , k) k∈K such that it penalizes the training process in order to optimize the score related to k * with respect to each key hypothesis k ∈ K. Thus, both solutions take into account (s(F Θ , k)) k∈K\{k * } to compute the gradient with respect to k * . They are intuitively useful to correctly optimize the score k * amongst all key hypotheses which is necessary to perform a successful side-channel attack.

While the penalization process related to the scenario j = k * is useful for the maximization of the score s(F Θ , k * ), some limitations can be highlighted when the negative log-likelihood with the softmax activation function is considered. Indeed, when j = k * , the derivative

∂L N LL (F Θ,N LL ,k * ) ∂s1(F Θ,N LL ,j)
does not adequately penalize the trainable parameters related to the j th class. Consequently, the probability term induced in Equation 7.12 can be impacted by a wrong penalization conducted on each (s 1 (F Θ,N LL , j)) j∈K\k * . Consequently, the loss function may emphasize irrelevant sensitive information. Thus, contrary to the ranking model obtained from the minimization of the empirical risk combined with the ranking loss, the model selected from the minimization of the empirical risk combined with the negative log-likelihood can be seen as an approximation of Pr[Y |T, Θ]. In the following, the distance between the probability distribution provided by F Θ,N LL and Pr[Y |T, Θ] is called Approximation Error and is negligible if and only if the probability distribution associated with F Θ,N LL is similar to the one related to the ranking model.

The link with the Mutual Information. As the approximation error suggests that a ranking model is at least, as efficient as a model F Θ,N LL using the negative log-likelihood loss function, the latter solution can be considered as a lower bound of the inequality introduced in Equation 7.11:

H (Y ) + y∈Y Pr [Y = y] 1 N p Np i=0 log 2 (F Θ,N LL (t i ) [y]) ≤ H (Y ) + y∈Y Pr [Y = y] N a N p Np/Na i=1 max Θ   Na-1 j=0 log 2 Pr Y = y|t j+Na•(i-1) , Θ   ≤ H (Y ) + y∈Y Pr [Y = y] t∈T Pr [T = t|y] log 2 (Pr [Y = y|t]) = M I (Y ; T) . (7.15)
Consequently, when the negative log-likelihood is used as a loss function, the number of leakage traces needed to reach a 1 st order success rate is defined as an upper bound of the optimal solution (see Theorem 7.2.1.1). Moreover, due to the approximation error, the number of attack leakage traces needed to perform a successful attack on F Θ,N LL is defined as an upper bound of the number of attack leakage traces needed to perform a successful attack on a model selected from the minimization of the empirical risk combined with the ranking loss. Thus, it illustrates that the latter solution is more efficient than the current usual negative log-likelihood loss function used in the side-channel context.

In the next section, we deeply analyze the errors made by the negative log-likelihood and we compare them with the ranking loss.

Error Analysis

The negative log-likelihood in side-channel context. In [START_REF] Masure | A comprehensive study of deep learning for side-channel analysis[END_REF], Masure et al.

study the theoretical soundness of the minimization of the empirical risk combined with the negative log-likelihood in order to conduct side-channel attacks. They demonstrate that minimizing this empirical risk is equivalent to maximizing an estimation of the Perceived Information [RSVC + 11] that is defined as a lower bound of the Mutual Information between a leakage trace and the targeted secret [BHM + 19]. Specifically, the perceived information is the amount of information that can be extracted from data with the help of an estimated model. Because the perceived information is substituted to the mutual information, some source of imprecision could affect the quality of the model F Θ . The gap between the estimation of the perceived information, defined by the minimization of the empirical risk combined with the negative log-likelihood, and the mutual information can be decomposed into three errors f :

• Approximation error -it defines the deviation between the perceived information obtained from a parametric model F Θ and the mutual information. In theory, the Kullback-Leibler divergence [START_REF] Kullback | On information and sufficiency[END_REF] can be computed in order to evaluate this deviation. However, the Evaluator faces the problem that the leakage Probability Density Function (PDF) is unknown.

• Estimation error -the minimization of the empirical risk combined with the negative log-likelihood maximizes the empirical estimation of the perceived information rather than the real value of the perceived information. Therefore, the finite set of profiling leakage f The readers should notice that these errors differ from those introduced by Masure et al. in [START_REF] Masure | A comprehensive study of deep learning for side-channel analysis[END_REF].

Indeed, Equation 7.19 defines the error related to the optimization of the model such that the ranking loss is considered. Finally, Equation 7.20 characterizes the estimation error that can be reduced when the number of profiling traces converges towards infinity [BHM + 19]. In Subsection 7.3.2, we will experimentally see that this error is reduced by up to 23% when the ranking loss is used compared to the classical categorical cross-entropy.

Error gap between the negative log-likelihood and the ranking loss. Finally, the gap between the negative log-likelihood and the ranking loss can be divided into different error terms. Here, we assume that the optimization error generated by both models is similar. This strong assumption is useful to simplify our analysis and focus on the benefits of using the ranking loss compared to the negative log-likelihood with softmax activation function. ). Indeed, the approximation error that defines the distance between the perceived information and the mutual information is removed when the success rate is maximized. One of the most challenging issues, induced by this approximation error, is then prevented when the ranking loss is considered.

Through this section, we demonstrate that a ranking model selected from the minimization of the empirical risk combined with the ranking loss can be considered as an approximation of the optimal distinguisher (see Definition 3.3.1.4). From this observation, we evaluate the distinctions between the penalization process induced by the negative log-likelihood and the ranking loss. While both approaches are useful to maximize the correct output with respect to each key hypothesis k ∈ K \ k * , the application of the negative log-likelihood does not properly penalize the irrelevant classes. Consequently, the probability distribution provided by F Θ,N LL induces an approximation error as its optimal model does not necessarily reflect the true unknown probability distribution Pr[Y |T]. This error is prevented by the ranking loss function. Thus, according to Theorem 7.1.3.1, a model obtained from the minimization of the empirical risk combined with the ranking loss is at least as efficient as a model obtained from a classical deep learning based side-channel approach.

SUM UP...

In the next section, we validate all the theoretical observations on unprotected and protected implementations.

Exploitation of the Ranking Loss

Settings. The experiments are implemented in Python using the Keras library [START_REF] Chollet | [END_REF] and are run on a workstation equipped with 16GB RAM and a NVIDIA GTX1080Ti with 11GB memory. All of the following architectures and hyperparameters are based on the results provided in Section 6.3 and can be reproduced [ZBD + 20a]. The attack leakage traces are randomly shuffled and picked up from a set of attack leakage traces I a . For a good estimation of N t rank , 100 realizations are performed to give the average value denoted N t rank . In the next sections, the number N a of attack leakage traces considered to compute the ranking loss (see Definition 7.1.2.1), is set to 1. Hence, the ranking loss tends to maximize the success rate when only 1 attack leakage trace is considered.

Comparison with the Cross-Entropy Ratio [ZZN + 20, ISUH21].

In the following, we compare the negative log-likelihood and the cross-entropy ratio (CER) loss functions with the ranking loss on different publicly available datasets. Given a set I p of N p elements such that I p = {(t 0 , y 0 ), . . . , (t Np-1 , y Np-1 )} with (t i , y i ) 0≤i<Np ∈ (T × Y), the empirical risk combined with the cross-entropy ratio has been introduced to deal with imbalanced data issues such that it is defined as:

R(L CER , F Θ ) = R(L N LL , F Θ ) -1 N N -1 r=0 R(L (r) N LL , F Θ )
, where R(L (r)

N LL , F Θ ) identifies the empirical risk combined with the negative log-likelihood such that the labels are shuffled while keeping the leakage traces unchanged.

From a practical perspective, the generation of suitable architectures is known as a difficult task. Hence, two scenarios can be considered. In Subsection 7.3.1, it is assumed that the Evaluator selects a model that exploits a partial set of PoIs. In Subsection 7.3.2, models that exploit all relevant information in the leakage traces are considered. This section evaluates the efficiency of the ranking loss compared to the negative log-likelihood and the cross-entropy ratio in both cases through various scenarios, notably in presence of high noise, masking and desynchronization.

A Partial Exploitation of the Leakages

For simplicity, we evaluate this case study with the ChipWhisperer dataset which is an unprotected emulation of AES-128 implemented in software on a Chipwhisperer board [START_REF] Flynn | Chipwhisperer: An open-source platform for hardware embedded security research[END_REF] (see Section 3.6 for deeper information). To construct the model, we follow the recommendations provided in Subsection 6.3.1. The implemented model is a CNN architecture with one convolutional block of 2 filters of size 1 and one fully-connected layer with 2 nodes. When considering unprotected implementation with low noise, all the models trained with different losses provide the same N t rank value (see Table 7.1 for small σ values). In Subsection 6.1.3, we propose to visualize the weights corresponding to the flatten layer in order to evaluate the capacity of the network to extract the relevant features. Through this visualization, the Evaluator is able to retrieve the points of interest selected by a neural network. However, due to the effect of the convolutional block, the number of weighted samples is divided by the value of the pooling stride (see Subsection 6.2.3). Thus, the comparison of these visualizations with the SNR computation can be difficult. For ease of visualization, we add padding on the weight representation in order to get the same x-axis on each figures. In Figure 7.2, we compare the features retained by the negative log-likelihood (see Figure 7.2a), the cross-entropy ratio (see Figure 7.2b) and the ranking loss (see Figure 7.2c) with the classical SNR (see Figure 7.2d). In this section, the comparison with an univariate leakage metric, such as SNR, is sufficient to assess the benefits of each loss as no interactions between the time samples are induced in the convolutional part of the CNN (i.e. the length of the filters is set to 1). Interestingly, depending on the loss, the model does not select the same relevant features. The Figure 7.2a, Figure 7.2b and Figure 7.2c do not show the same points of interest. While the SNR computation reveals 4 high peaks between 0 and 200 samples, the models trained with the negative log-likelihood and the cross-entropy ratio losses detect only 2 high peaks in the same area. Hence, only a partial set of leakages is exploited by these cross-entropy losses. In comparison, the ranking loss extracts most of the sensitive information. Moreover, the negative log-likelihood loss identifies a false-positive leakage while no irrelevant peak occurs when the ranking loss is applied. This error underlines an important issue when the negative log-likelihood loss is used in side-channel: the approximation error is non-negligible and some false-positive leakages can occur. If the Evaluator cannot find a more suitable neural network architecture, these noisy points (i.e. irrelevant PoIs) could dramatically impact the performance of the network. As mentioned in [START_REF] Durvaux | How to certify the leakage of a chip?[END_REF], the approximation (or assumption) error can be dramatic if the model, characterizing the perceived information, does not converge towards the right distribution Pr [Y |T] defined by the mutual information M I (Y, T). In Subsection 7.2.3, we have shown that the ranking loss prevents the approximation error compared to the negative log-likelihood. Hence, when the ranking loss is used, the related performance should be, at least, as good as a model trained with the negative log-likelihood.

If the PoIs amplitude is low compared to the noise, the performance gap between a model trained with the negative log-likelihood, the cross-entropy ratio and the ranking loss could increase. To illustrate this phenomenon, we add Gaussian noise N D (0, σ • I D ) such that σ defines the standard deviation of the noise and D denotes the dimension of the leakage traces. Table 7.1 shows the evolution of the N t rank value depending on the added noise on the Chipwhisperer dataset. When the additional noise level is low (i.e. σ ≤ 10 -2 ), the feature detection is effective regardless of the loss function and the performance gap is low (i.e. less than 9). However, for high noise level (i.e. σ ≥ 10 -1 ), the performance gap increases dramatically and reaches 1, 031 when we compare the negative log-likelihood and the ranking loss and 885 when we compare the cross-entropy ratio and the ranking loss. The ranking loss is clearly the most efficient loss function, even in the presence of high noise levels. In conclusion, if the Evaluator generates a model that does not exploit the entire set of leakages, he shall use the ranking loss in order to obtain a model mitigating the approximation error. Indeed, depending on the level of the SNR peaks, this error can dramatically impact the performance of a network. However, from a practical perspective, a model trained with the ranking loss can also extract false-positive leakages due to the optimization error. But, if the hyperparameter α is correctly configured, its overall error rate stays a lower bound of the error rate generated by a model trained with the negative-log likelihood loss function (see Subsection 7.2.3) with the assumption that the optimization errors are similar. The evaluation of the approximation error was also made on the AES_HD and the ASCAD datasets but the architectures proposed in Subsection 6.3.1 already give the same best solution for all the losses. For these datasets, we can assume that the approximation error is negligible. Hence, we assume that all losses exploit the entire set of relevant information. The next section evaluates the benefits of the ranking loss against the negative log-likelihood and the cross-entropy ratio when all leakages are detected.

Remark 7.3.1.1. In this experiment, we noticed that when the noise level is high, the best value of α used by the ranking loss decreases. Consequently, α is configured to obtain the most powerful model when the noise level is high. Even if the resulted performance is similar for many values of α, this observation illustrates that α should be correctly configured depending on the characteristic of the traces (i.e. level of noise, number of profiling traces ...).

A Total Exploitation of the Leakages

As mentioned, given the architecture provided in Section 6.3, the entire set of PoIs is detected on the AES_HD and the ASCAD datasets (see Figure 6.7 and Figure 6.8). Hence, we can assume that the approximation error does not impact the overall performance of the model regardless of the loss function used. When all the losses converge towards the same best solution, a comparison method consists in the evaluation of the number of profiling leakage traces that are needed to reach this performance. From the Evaluator point of view, it is more interesting to converge faster towards the best solution because it is difficult to estimate a priori the number of profiling leakage traces needed to reach the best performance. To highlight the benefits of each loss, we decompose this experimental study into an Estimation Error Gap (EEG) and a performance gap evaluation. When various losses are used, the EEG characterizes the difference between the number of profiling leakage traces N p that are needed to reach a given N t rank value. We note EEG(L i , L j ) the EEG value between models obtained from the loss functions L i and L j . For each dataset, we average the performance results given by 10 models converging towards a constant guessing entropy of 1. Then, we display the evolution of the average N t rank value for different levels of N p . When the number of profiling traces is low (i.e. N p ≤ 30, 000), some models do not retrieve the sensitive information and the resulted N t rank value cannot be estimated. In order to fairly compare the losses, we only consider the models for which the N t rank value can be computed for all the learning metrics.

AES_HD. In Figure 7.3a, we compare the convergence capacity of each model depending on the loss used. When the model is obtained from the ranking loss, only 20, 000 profiling leakage traces are needed to perform a successful attack such that N t rank = 2, 500. To reach the same performance, a model trained with the negative log-likelihood needs 24, 700 profiling traces. Thus, when N t rank = 2, 500, EEG(L RkL , L N LL ) = 4, 700. Similarly, if the Evaluator chooses the crossentropy ratio as loss function, he needs to increase its training set by 4, 800 traces to perform similar attacks. When the ranking loss is used, the number of profiling traces needed to reach a constant N t rank solution is, in the worse case, similar to the cross-entropy propositions (i.e. negative log-likelihood, cross-entropy ratio). Through Table 7.2, we compare the performance of each loss for a given number of profiling traces. When N p is low (i.e. ≤ 30, 000), the performance gap is relatively high (up to 8, 293 traces) between the ranking loss and the cross-entropy losses. Hence, when the number of profiling leakage traces is limited (as often in practice), the ranking loss is the most efficient loss function. However, as defined in [START_REF] Masure | A comprehensive study of deep learning for side-channel analysis[END_REF], if the number of profiling traces is large enough and no approximation error occurs, the performance gap is reduced and the negative log-likelihood loss function generates a model that converges towards the same best solution (see Table 7.2). The same observation can be made if we consider the cross-entropy ratio loss function. These experimental results confirm the theoretical propositions of Subsection 7.2.3 such that the ranking loss is, at least, as efficient as a model trained with a cross-entropy loss function (e.g. negative log-likelihood, cross-entropy ratio).

Remark 7.3.2.1. In comparison with the negative log-likelihood function, the training time can be impacted when the ranking loss is considered. Following Definition 7.1.2.1, the partial ranking loss function has to be summed over K. Hence, the training time needed to reach a given number of epochs could be increased depending on the leakage model (e.g. identity, Hamming Weight). The lesser the number of classes (or key hypotheses), the lesser the training time is impacted. For the AES_HD dataset, the worst-case scenario is considered when 8 bits are targeted (i.e. |K| = 256). The best-case scenario will be considered in Chapter 8 (i.e. |K| = 2 and |K| = 3). In comparison with the cross-entropy losses, the training time increased by 10s, when N p = 15, 000, and by up to 145s for 45, 000 profiling leakage traces. In the worst-case scenario (i.e. N p = 45, 000), the training time is multiplied by 4. Remark 7.3.2.2. The value α of the ranking loss needs to be adapted depending on the number of profiling traces. For example, when N p is low, the risk of overfitting is a major issue. One solution, to limit the overfitting effect, is to fix a higher learning rate [START_REF] Hoffer | Train longer, generalize better: Closing the generalization gap in large batch training of neural networks[END_REF][START_REF] Smith | Super-convergence: Very fast training of residual networks using large learning rates[END_REF]. Hence, following Equation 7.8 and Equation 7.9, α can be monitored as the learning rate, in order to optimize the training process. For the AES_HD dataset, increasing α to 10 generates a more powerful model than α equal to 1 (see Appendix B) when the number of profiling traces equals 20, 000.

ASCAD.

In contrast with the previous datasets, ASCAD is a protected implementation with 15, 000 profiling traces are needed to perform a successful attack, such that N t rank = 1, 700, while 18, 500 (resp. 20, 000) are needed to reach the same performance when the negative log-likelihood (resp. cross-entropy ratio) loss is used for the training process. Consequently, if the Evaluator chooses the negative log-likelihood (resp. cross-entropy ratio) as loss function, he needs to increase its training set by 3, 500 (resp. 5, 000) profiling leakage traces on average. Thus, when N t rank = 1, 700, EEG(L RkL , L N LL ) = 3, 500. Furthermore, when no desynchronization occurs, the model converges faster towards the average best solution (i.e. N t rank ≈ 260) when the ranking loss is used (i.e. N p = 35, 000) compared to the negative log-likelihood or the cross-entropy ratio losses (i.e. about 45, 000 profiling traces). The resulting EEG value equals 10, 000. This estimation error gap is up to 6, 000 profiling traces when desynchronization occurs (see Figure 7.4a and Figure 7.4b) h . Hence for the ASCAD dataset, EEG is not increased with the desynchronization effect. Indeed, in comparison with synchronized traces, this countermeasure only impacts the exploitation of the relevant information. Finding suitable CNN architectures reduce the desynchronization effect (see Chapter 6) while preserving the same performance as a model trained with synchronized traces. Through Table 7.3, we confirm the observations on the AES_HD dataset. In our experiment, for a small number of profiling traces N p (i.e. ≤ 25, 000), a model trained with the ranking loss is, on average, more efficient than one trained with the negative log-likelihood or the crossentropy ratio. For synchronized and desynchronized traces, the Evaluator with a limited number of profiling traces shall use the ranking loss.

When the entire set of PoIs is detected by the network, a model trained with the ranking loss converges faster towards the best solution compared to the negative log-likelihood and the crossentropy ratio losses. From a theoretical perspective, we can assume that the estimation error is reduced when the ranking loss is considered. However, when the number of profiling traces N p is large enough, we validate that the impact of the estimation error can be negligible. However, in practice, the number of profiling traces is limited. For that purpose, the ranking loss function seems to be more appropriate with the assumption that the Evaluator does not have an infinite number of traces in the profiling phase [START_REF] Picek | Profiling side-channel analysis in the restricted attacker framework[END_REF]. Hence, the ranking loss is a solid alternative to the negative log-likelihood for performing side-channel attacks.

Remark 7.3.2.3. As previously mentioned, depending on the number of classes, the training time can be impacted when the ranking loss is considered. In comparison with the cross-entropy losses, the training time is increased by 60s, when N p = 15, 000, and by up to 253s when 45, 000 profiling traces are used for generating a network on the ASCAD dataset when no desynchronization occurs. In the worst-case scenario (i.e. N p = 45, 000), the training time is multiplied by 1.9. In addition, when a random delay effect with a maximum amplitude of 100 samples is implemented (i.e. "Desync 100"), the neural network architecture proposed in Section 6.3 is more complex than the neural network architecture trained on the synchronized traces (16, 960 against 142, 044 trainable parameters). In comparison with the cross-entropy losses, the model obtained from desynchronized leakage traces increases the resulted training time by 97s, when N p = 15, 000, and by up to 290s when 45, 000 profiling traces are considered. Hence, the training time is multiplied by 2 in the worst-case scenario (i.e. N p = 45, 000). Hence, through this example, a more complex neural network does not impact a lot the training time induced by the ranking loss. However, a further study should be made to validate this observation on deeper networks.

Remark 7.3.2.4. As mentioned earlier, the value α of the ranking loss needs to be adapted depending on the number of profiling traces. For example, when N p = 15, 000 traces, increasing α to 5 generates a more powerful model than α = 0.5 (see Figure B.1b) if the desynchronization effect equals 100. Finally, as we can see in Figure 7.4b and Table 7.3, a model obtained from the crossentropy ratio does not converge towards a constant GE of 1 when the random-delay effect equals 100. However, the cross-entropy ratio aims at reducing the imbalanced effect [ZZN + 20, ISUH21] which is not considered in this manuscript.

Conclusion

This chapter proposes a new loss function which is derived from the success rate metric. Indeed, we extend the work done by Masure et al. [START_REF] Masure | A comprehensive study of deep learning for side-channel analysis[END_REF] that consists in the interpretation and the explainability of the loss functions in the side-channel context. We use the learning to rank approach in order to propose a new loss, called Ranking Loss. We theoretically demonstrate that maximizing the success rate is equivalent to minimizing the ranking error of the secret key compared to all other hypotheses. Hence, the ranking loss tends to maximize the success rate for a given N a leakage traces and converges towards the optimal distinguisher introduced in Definition 3.3.1.4. Through this new proposition, we are more concerned with the relative order of the relevance of the key hypothesis than their absolute value. This result notably allows preventing the approximation error induced by the softmax function considered by the negative log-likelihood loss function. While the minimization of the empirical risk combined with the ranking loss generates a model that converges towards the mutual information between the sensitive information Y and the leakage trace T, its application is helpful to optimize the side-channel performance metrics that are considered to assess the robustness of a cryptographic module.

All these observations are experimentally validated through two scenarios. Firstly, if the Evaluator does not generate a model exploiting all the sensitive information from a leakage trace, using the ranking loss prevents the approximation error and provides a good alternative to the negative log-likelihood loss function. Otherwise, if the Evaluator generates a model that exploits the entire set of leakages, the model trained with the ranking loss converges faster towards the best solution compared to the cross-entropy losses (i.e. negative log-likelihood and the cross-entropy ratio). Hence, if the Evaluator deals with a limited number of traces, using the ranking loss should provide the most efficient model. Consequently, in all situations, the Evaluator shall consider the ranking loss as a clear alternative to the negative log-likelihood.

As the ranking loss approximates the mutual information between a sensitive information Y and a leakage trace T, its application in side-channel context sounds natural. However, as mentioned in Section 7.3, the related training time can be impacted by the number of output classes. Indeed, following Definition 7.1.2.1, a sum over K has to be performed in order to compute the empirical risk combined with the ranking loss. To assess the suitability of the ranking loss on a wide-range of side-channe use-cases, the following chapter proposes to target cryptographic module implementing asymmetric algorithms (i.e. RSA and ECC). In such scenario, side-channel attacks aim to recover a secret key using the least number of leakage traces. Thus, increasing an attack's accuracy is particularly important when the Evaluator targets public-key cryptographic implementations where the recovery of each secret key bits is directly related to the model's accuracy. Commonly used in the deep learning field, ensemble models are a well suited method that combine the predictions of multiple models to increase the ensemble accuracy by reducing the correlation between their errors. One common solution to optimize ensemble models is to maximize an approximation of the mutual information between the ensemble model and the targeted sensitive information. From the knowledge acquired in this chapter, we extend the notion of ranking loss to the ensemble model and enhance the related attack performance against public-key cryptographic implementations.

WHAT'S NEXT?

Chapter 8

Efficiency through Diversity in Ensemble Models

A common solution to enhance the performance of the deep learning approach consists in combining individual predictions from several parametric models via a consensus method (e.g. majority vote, average vote) in order to reduce the global error. We study this technique, called Ensembling, in order to defeat cryptographic module implementing asymmetric algorithms. First, we recall the Evaluator' restrictions occurring during the evaluation of such implementations. From these observations, we motivate the need of accuracy gains and translate it to a drastic reduction of the remaining time complexity of a side-channel attack. This scenario fits with the Ensembling approach such that constructing ensemble models is beneficial to diversify the predictions induced by each of its member and thus, enhancing the attack performance. Then, we propose a new loss, namely Ensembling Loss, that generates an ensemble model which increases the diversity among its members. Based on the mutual information between the ensemble model and its related label, we theoretically demonstrate how this loss generates interaction between the ensemble members during the training process. It is further beneficial from the Evaluator perspective because he can reconsider the robustness of cryptographic module against side-channel attacks. We conclude this chapter by validating our theoretical observations on diverse datasets and side-channel attack scenarios. The solutions proposed in this chapter have been presented at CHES and published in the journal IACR TCHES [ZBHV21b]. Targeting symmetric vs. asymmetric implementations. As explained in Subsection 3.3.4, the attack process differs depending of the targeted cryptographic algorithms. While side-channel attacks against symmetric algorithm implementations usually target 8 bits, a key recovery attack against asymmetric algorithm implementations is considered as successful if, for one or few attack leakage traces, the Evaluator retrieves the whole private key s k * ∈ F n 2 . Indeed, due to a careful combination of countermeasures (e.g. message blinding, modulus randomization, exponent/scalar blinding, point blinding), the Evaluator must be able to recover most of the secret bits from one or few leakage traces. Typically, two scenarios can be considered:

Contents

• N leakage traces exploitation -The Evaluator wants to recover the secret from a set of N leakage traces that share the same secret exponent/scalar s k * . This use case corresponds to ECDH (Elliptic Curve Diffie-Hellman) or RSA signature computations when exponent/scalar blinding countermeasure is applied. In this scenario, the Evaluator wants to recover the blinding factor related to each of those N leakage traces in order to recover s k * (deeper details are provided in Subsection 8.1.2).

• 1 leakage trace exploitation -The Evaluator has access to only 1 leakage trace in order to recover the secret exponent/scalar s k * . This use case corresponds to ECDSA (Elliptic Curve Digital Signature Algorithm) targeting the scalar multiplication with a random nonce a .

Consequently, instead of aggregating the output probability of a Θ-parametric model F Θ over multiple leakage traces, the Evaluator's strategy consists in making use of the accuracy of F Θ to retrieve each private key bit (s k * [i]) 0≤i<n . If F Θ does not correctly find each bit with 100% accuracy, the Evaluator has to perform additional operations, called Remaining Operations (see Definition 3.3.4.6), to retrieve the last bits of the private key. Hence, the accuracy of the attack is crucial in order to lower the remaining operations required to find the entire secret key s k * .

Practicability and remaining brute-force complexity. To define the practicability of an attack, the European SOG-IS scheme b introduces three complexity measures [SI20, Section 1.3]:

• Time complexity -This metric corresponds to the number of offline computations the Evaluator can perform in order to extract the targeted data from the cryptographic module. This notion does not consider the computation power available to the Evaluator (e.g. parallelization). This term is characterized by the Remaining Operations introduced in Definition 3.3.4.6.

• Memory complexity -This metric defines the amount of memory the Evaluator needs to store the acquired leakage traces and perform the related attack.

• Data complexity -The metric quantifies the amount of interactions the Evaluator needs with the targeted cryptographic module in order to perform his attack.

a Nonce is the abbreviation of "number only used once". It refers to any arbitrary random number and it is useful to mitigate the impact of some attacks (e.g. replay attacks)

b As remainder, the Senior Officials Group Information Systems Security (SOG-IS) agreement defines a set of requirements and evaluation procedures related to cryptographic aspects of CC security evaluations of IT products and mutually agreed by SOG-IS participants. The interested readers may find useful information in https://www.sogis.eu/index_en.html.

While these three metrics can be combined following the Evaluator's capability (e.g. the time complexity can be reduced by increasing the memory or the data complexity), this manuscript only considers the time complexity measure for assessing the practicability of an attack. Thus, we put this chapter in a general context where no assumption is provided related to the Evaluator's capability. To measure the time complexity, the Evaluator considers the number N op,α of remaining operations depending on the accuracy α obtained from a Θ-parametric model F Θ . We define the Attack Complexity as log 2 (N op,α ). In [START_REF]Crypto evaluation scheme agreed cryptographic mechanisms[END_REF], the SOG-IS agreement considers that a maximum attack complexity of around 100 (i.e. N op,α = 2 100 operations) is practical.

Hence, to fit with the Evaluator's restrictions, the following sections consider this threshold to evaluate if an attack becomes feasible. Furthermore, while no theoretical result links the accuracy and the remaining operations, we experimentally evaluate how the accuracy impacts the final attack complexity.

Complexity Measures

In this section, we consider three attack complexity measures, namely Naive complexity, 2 bcomplexity and Alternate attack complexity, such that, depending on the targeted asymmetric cryptographic implementations, we can assess how the gain of accuracy influences the resulted side-channel attack complexity. The goal of the adversary is to recover a blinded secret key composed by a secret exponent/scalar s k * (resp. blinded exponent/scalar) of bit-length n (resp. r).

Naive complexity. In this scenario, the Evaluator guesses the bits related to s k * based on a Θ-parametric model F Θ and a leakage trace T. While some of the guessed bits may be wrong, the Evaluator cannot locate them among the n bits of s k * as he cannot perfectly distinguish the process s k * [j] = 0 from s k * [j] = 1 for 0 ≤ j < n. The Naive complexity metric measures the number of combinations the Evaluator has to perform in order to correctly recover s k * . Thus, given a secret exponent/scalar s k * of n bits, a blinding exponent/scalar of bit-length r and an error rate bit ∈ [0, 1], the Naive Complexity, denoted C N C , is defined as:

C N C (n, r, bit ) = log 2   (n+r)× bit i=0 n + r i   ,
where (n + r) × bit denotes the number of erroneous bits related to the secret blinded exponent/scalar of n + r bits. Indeed, as the Evaluator cannot identify the correct from the wrong predictions, he has to compute all the possible combinations. This attack complexity metric considers the worst-case scenario.

2 b -complexity. This scenario is similar to the naive complexity metric. However, while the previous case suggests that the Evaluator cannot locate the wrongly guessed bits of s k * , this scenario assumes that the Evaluator can locate the uncertain predictions. For example, given a leakage trace T, the Evaluator defines the related predictions as uncertain if the probability assigned to one hypothetical bit value does not exceed a given threshold. Thus, given a secret exponent/scalar of n bits, a blinding exponent/scalar of bit-length r and a percentage of bits bit under a given threshold, the 2 b -complexity, denoted C 2 b , is defined as the best-case scenario such that:

C 2 b (n, r, bit ) = (n + r) × bit .
Indeed, as each uncertain prediction has 2 possible values (i.e. {0, 1}), the resulted number of remaining operations is 2 (n+r)× bit . In the following, an attack that can be performed with 2 b -complexity is called a 2 b -attack.

Alternate attack complexity.

s k * = s k * + R • φ(N ),
where s k * is the secret exponent and φ(N ) defines the Euler totient function of the modulus N .

In the alternative attack scenario against RSA without CRT, it is assumed that the attacker knows the upper halves of the binary representation of φ(N ) because it is similar to N . Let n be the bit-length of the secret exponent and

s k * j = s k * 2 j
defines the bits of s k * shifted to the right by j places. If j ≥ n 2 + r + 6, then s k * 2 j depends on the upper half of the bits of φ(N ).

Given a secret blinding exponent s k * , Schindler and Wiemers introduce α = s k * 2 n-1 and β such that 0 ≤ β < 2 n-1 < φ(N ) to rewrite s k * in such a way that the (r + 1) most significant bits influence α while the (n -1) least significant bits influence β. Then, the authors define (s k * j) as:

(s k * j) = s k * + R • φ(N ) 2 j = α2 n-1 + β 2 j , and, (s k * j) = (s k * mod φ(N ) j) = α2 n-1 (mod • φ(N )) + β -ωφ(N ) 2 j = α2 n-1 (modN ) + β -ωN 2 j ,
with high probability for an unknown ω ∈ {0, 1} and j ≥ n 2 + r + 6. When the Evaluator captures the leakage traces, he guesses the randomized exponent to obtain an estimation ŝ k * of the true blinded exponent s k * :

ŝ k * 2 j = s k * ⊕ e 2 j = α2 n-1 + β 2 j ,
where e expresses the guessing error induced by exponent ŝ k * , '⊕' denotes the bitwise XOR operation, α (resp. β, ω) is an estimation of α (resp. β, ω).

Given an error rate bit , the Evaluator can estimate the number of erroneous bits in α. The idea of the alternative attack against RSA without CRT is to generate all candidates for α (denoted αc ) and compute the resulted blinding factor candidates as R c = (ŝ k * -ŝk * )/N = αc 2 n-1 /N + ω with ω ∈ {0, 1}. Then, for each candidate αc and R c , the Evaluator can compute an estimation of the resulted error ê based on a guess on the secret exponent s k * such that:

ê = R c N + ŝk * 2 j 2 j ⊕ αc 2 n-1 + β . If ŝk * 2 j
= s k * 2 j , a blinding factor estimation R c is defined as a candidate for R if HW ê/2 j ≤ t 0 with t 0 a threshold configured by the Evaluator. A smaller t 0 value induces a more restrictive candidate selection. The threshold t 0 should be selected such that no false candidates for R are kept. More details on the alternative attack algorithm are provided in [SW14, Algorithm 4]. However, it is acceptable that some of the ŝk * /2 j candidates are wrongly guessed. Then, to retrieve the remaining bits of φ(N ), the adversary has to perform the Step 3 of the Enhanced Attack introduced by Schindler and Itoh [START_REF] Schindler | Exponent blinding does not always lift (partial) spa resistance to higher-level security[END_REF]. Of course, for a number N a of attack traces, we expect q x0,t0 N candidates for s k * /2 s where,

q x0,t0 =   i≤x0 r + 1 i i bit (1 -bit ) r+1-i   •   i≤t0 n -1 -j i i bit (1 -bit ) (n-1-j)-i   ,
such that, the two brackets quantify the probabilities that α and the most significant bits of β contain at most x 0 or t 0 guessing errors, respectively [START_REF] Schindler | Generic power attacks on rsa with crt and exponent blinding: new results[END_REF]. Through all these components, we can estimate the complexity of the resulted alternate attack for a given j and t 0 values. First, the Evaluator has to configure the j, t 0 and N a values to perform successful attacks. Then, for a given ŝ k * = α2 n-1 + β, the Evaluator has to generate all αc candidates that differ by x 0 bits from α at most. Hence, there are M 0 = i≤x0 r + 1 i candidates for α.

The computation of each candidate R c and êc depends on the number of αc elements. Therefore, there are 2 • M 0 candidates for R , 2 • M 0 • 2 n-j candidates for e in the worst case (i.e. if ŝk * /2 j = s k * /2 j ) or 2 • M 0 candidates for e otherwise (i.e. if ŝk * /2 j = s k * /2 j ). In the following, we only consider the worst-case scenario for the attack complexity estimation. Given an n-bit secret exponent s k * , an r-bit blinding exponent, an error rate bit and a number of attack traces N a , the alternate attack complexity C AA is defined as:

C AA (n, r, bit , N a ) = log 2   N a • 2 n-j+1 • (r+1)× bit i=0 r + 1 i   ,
with t 0 configured such that no false candidates for R are selected.

To consider the alternate attack has a success, the Evaluator has to define the number of attack traces N a that are needed to recover the full bits of φ(N ). Hence, to correctly estimate C AA , the Evaluator has to perform the Step 3 of the enhanced attack [START_REF] Schindler | Exponent blinding does not always lift (partial) spa resistance to higher-level security[END_REF] in order to find a correct assumption about N a . We consider an alternate attack as ineffective if the success rate related to φ(N ) is less than 100% when 300 successive alternate attacks are performed.

Remark 8.1.2.1. In [SW17], Schindler and Wiemers set j = n -r + 2 and t 0 = 2 for r = 32. Even if using the same parameters is restrictive when r = 64, these conditions respect the above result. Thus, the alternate attack complexity considered in Subsection 8.4.1 employs those parameters.

All these complexity measures are helpful to evaluate the efficiency of an attack. These tools are suited to highlight the impact of the accuracy on the resulted attack complexity. As bit = 1-α bit , with α bit denoting the accuracy of retrieving one bit of s k * , it can be observed that a slight improvement in α bit can drastically reduce all the attack complexity metrics introduced above. Thus, a slight improvement in terms of accuracy is non-negligible from a side-channel perspective.

This result leads us to investigate the benefits of using Ensembling approach in side-channel context in order to defeat asymmetric cryptographic implementations.

The Principle of Ensembling

In machine learning, ensemble methods combine individual predictions from parametric models of a pool via a consensus method (e.g. majority vote, average) [HS90, [START_REF] Kuncheva | Combining Pattern Classifiers: Methods and Algorithms[END_REF][START_REF] Zhou | Ensemble Methods: Foundations and Algorithms[END_REF]. These approaches are useful when the models of the ensemble, known as committee members, learn and predict uncorrelated errors. Hence, a simple consensus method can efficiently reduce the global error of the system. However, in practice, the errors induced by the committee members are correlated and the overall ensemble error reduction is hard. One solution to reduce this correlation is to conduct a diversity investigation on the members in order to reduce the global error and increase to some extent, the ensemble performance [START_REF] Dietterich | Ensemble methods in machine learning[END_REF]. The following sections deeply characterize these observations.

A Source of Diversity

E add,ens = E add 1 + δ(N c -1) N c , (8.1)
where δ is a correlation factor that quantifies the error dependence among the parametric models. From Equation 8.1, we can easily evaluate the benefits of using ensemble methods to reduce the global error. If δ is 0, then the errors induced by the parametric models are independent and the ensemble expected added error is divided by N c . Therefore, the global error will be N c times smaller than the individual error provided by each parametric model included in E. On the other hand, if δ is 1, the errors induced by the parametric models are correlated and E add,ens characterizes the average error of each classifier. To ensure uncorrelated errors, the classifiers included in the ensemble model must be diverse [START_REF] Dietterich | Ensemble methods in machine learning[END_REF].

Ensemble Diversity Definitions. Diversity has been recognized as a very important concept in parametric models combination [START_REF] Cunningham | Diversity versus quality in classification ensembles based on feature selection[END_REF][START_REF] Lam | Classifier combinations: Implementations and theoretical issues[END_REF]. Indeed, it characterizes the difference among individual members of a committee E. However, in the machine learning literature, there are multiple techniques that serve the ensemble diversity. For example, bagging [START_REF] Breiman | Bagging predictors[END_REF] and boosting [START_REF] Freund | Experiments with a new boosting algorithm[END_REF] manipulate input data to promote diversity by choosing different subsets of input during the training process while other approaches consist in diversifying the neural network architectures considered by each parametric model in E. In this manuscript, the diversity is defined as follows:

Definition 8.2.1.1 (Diversity). Given an ensemble model E composed by N c committee members (F n ) 0≤n<Nc , the diversity is defined as a quantity measuring the difference among the elements of E based of their predictions.

This definition is not new and was already considered by the machine learning community (e.g. majority vote [START_REF] Morvant | Majority vote of diverse classifiers for late fusion[END_REF], PAC-Bayesian theory [GMGA17], . . . ). From Definition 8.2.1.1, diversity is greater when the parametric models that make wrong decisions for a given example spread their decisions more evenly over the possible incorrect decisions. Indeed, the more uniformly distributed the errors are, the greater the diversity. In [START_REF] Fumera | A theoretical and experimental analysis of linear combiners for multiple classifier systems[END_REF], Fumera and Roli found that the performance of ensembles depends on the performance of individual classifiers and their correlation. To efficiently promote the ensemble diversity, the output of the ensemble model E can be decomposed into three categories [START_REF] Xu | Methods of combining multiple classifiers and their applications to handwriting recognition[END_REF][START_REF] Kuncheva | Combining Pattern Classifiers: Methods and Algorithms[END_REF].

Let E = {F 0 , F 1 , • • • , F Nc-1 } be a set of N c parametric models and C = {c 0 , c 1 , • • • , c |K|-1
} be a set of |K| labels (or classes). For a given input T, we can define these categories as follows:

• Abstract level -Each parametric model (F n (T)) 0≤n<Nc outputs unique value included in C. Thus, the N c predictions define a vector in C Nc that characterizes the output of E.

Based on this vector, the Evaluator can define the diversity induced in E.

• Oracle level -The output of F n (T) is 1 if T is correctly classified by F n , and F n (T) = 0 otherwise. This representation is called oracle because the Evaluator has to know the label for each input in order to configure the output of E.

• Measurement level -The output of F n (T) is defined by a vector of posterior probabilities

Pr[c 0 |T], Pr[c 1 |T], • • • , Pr[c |K|-1 |T]
that quantifies the confidence in the prediction of each class (c i ) 0≤i<|K|-1 . Hence, the output of the ensemble model E is characterized by N c confidence vectors of size |K|.

The measurement level contains the highest amount of information while the abstract level contains the lowest [START_REF] Xu | Methods of combining multiple classifiers and their applications to handwriting recognition[END_REF]. In this manuscript, we want to precisely measure the diversity between each parametric model of the committee E. For that purpose, we focus only on the posterior probability representation to evaluate the performance and the diversity of an ensemble model E. These probabilities will be combined following the Average Method [START_REF] Xu | Methods of combining multiple classifiers and their applications to handwriting recognition[END_REF] to define the overall performance of E but a comparison will also be provided with Voting in Subsection 8.4.3. The average method consists in predicting the most likely class based on the average conditional probability of observing each element of C over E. Thus, based on the measurement level, the Evaluator has to design an ensemble model E such that the diversity between the committee members is optimized. However, the diversity methods are legion and it could be hard to categorize them. In [LWC + 19], Liu et al. decompose the diversity into three categories:

• Type I diversity characterizes the variety of committee members' structure such as types of neural network (e.g. multi-layer perceptrons, fully-connected neural networks, convolutional neural networks, recurrent neural network, residual neural network), weight initialization, training dataset, optimizer hyperparameters (e.g. optimizer algorithm, learning rate, number of epochs).

• Type II diversity selects a subset of parametric models included in E that minimize their errors correlation. Hence, the resulted ensemble model E promotes independence between its members and tends to reduce the related global error.

• Type III diversity forces the ensemble model E to decorrelate the errors generated by each of its parametric model (F n ) 0≤n<Nc during the training process. Hence, an error decorrelation penalty term is incorporated in the loss function to create complementary members and consequently, reduces the overall error.

The type II and the type III diversities are both defined and quantified based on the disagreement among the parametric model included in E. While the type II diversity captures the disagreement measure of each committee member after the training process for selecting a subset of parametric models E , the type III diversity considers the posterior probability representation to create and promote interactions during the profiling phase. Hence, even if an ensemble model E is composed by committee members with a high disagreement measure, applying the type III diversity is useful to penalize the remaining error correlation and providing a slight improvement of the ensemble model's performance as recommended in Section 8.1. Consequently, we design a solution to satisfy the type III diversity by proposing a new loss that promotes the penalization of correlated errors during the training process. This metric is based on the mutual information between an ensemble model and its related labels.

The next section introduces the concept of mutual information ensemble diversity as a foundation of our proposition. In addition, to efficiently evaluate the overall benefits of using ensemble methods in side-channel context, we combine all types of diversity in Section 8.4.

Mutual Information Ensemble Diversity

Type III diversity can be characterized by the application of a specific loss function promoting the diversity between committee members. Unlike the correlation that is classically employed to measure the similarity between two entities, the mutual information captures non-linear statistical dependencies between variables. Hence, this measurement can be used as a real source of dependence information [START_REF] Kinney | Equitability, mutual information, and the maximal information coefficient[END_REF]. In [START_REF] Brown | An information theoretic perspective on multiple classifier systems[END_REF], Brown evaluates the benefits of using mutual information to improve ensemble models. In [START_REF] Zhou | Multi-information ensemble diversity[END_REF], Zhou rewrites the ensembling as a communication channel problem such that it can be summarized as follows:

From an information theoretic point of view, let Y be a message sent through a communication channel and X be the received value such that X should be decoded to recover the input message Y . For that purpose, a decoding function g(.) is defined such that an estimation of the message can be written as Ŷ = g(X). From a machine learning perspective, X is the set of features characterizing the input of a learner g(.) and Y is the true unknown label. From ensembling paradigm, the goal is to recover Y from a set of N c models X 0:Nc-1 = {X 0 , X 1 , . . . , X Nc-1 } by a combination function g(.) such that during the training process, we want to minimize

Pr [g({X 0 , X 1 , . . . , X Nc-1 }) = Y ].
For any model g, [Fan61, HR70, Bro09] provide theoretical bounds for Pr [g(X 0:Nc-1 ) = Y ] such that:

H(Y ) -M I(X 0:Nc-1 ; Y ) -1 log(|Y |) ≤ Pr [g(X 0:Nc-1 ) = Y ] ≤ H(Y ) -M I(X 0:Nc-1 ; Y ) 2 .
Hence, to minimize Pr [g(X 0:Nc-1 ) = Y ], we have to maximize the mutual information between X 0:Nc-1 and Y .

ENSEMBLING AND INFORMATION THEORY

In [START_REF] Brown | An information theoretic perspective on multiple classifier systems[END_REF], Brown proposes a solution to compute the mutual information between an ensemble model E = {X 0 , X 1 , . . . , X Nc-1 } and a set of true unknown labels Y .

Definition 8.2.2.1 (Mutual Information Ensemble Diversity [START_REF] Brown | An information theoretic perspective on multiple classifier systems[END_REF][START_REF] Zhou | Multi-information ensemble diversity[END_REF]). Given an ensemble model E composed by N c committee members (F n ) 0≤n<Nc and a targeted sensitive variable Y , the mutual information ensemble diversity is defined as:

M I(E; Y ) = Nc-1 n=0 M I(F n ; Y ) - Nc-1 n=1 En⊆E M I({E n }) + Nc-1 n=1 En⊆E M I({E n }|Y ), ( 8

Mutual Information Ensemble Diversity Estimation

This section proposes a new empirical risk derived from Equation 8.3 in order to maximize an approximation of the pairwise mutual information M I(E; Y ) and the diversity between the committee members. To this end, we propose three empirical risks combined with three losses namely Relevance loss, Conditional Redundancy loss and Redundancy loss. In order to achieve a general-purpose estimator, we base our propositions on the characterization of the mutual information as the Kullback-Leibler (KL-) divergence [START_REF] Kullback | On information and sufficiency[END_REF] between the joint distribution and the product of the marginals. In Appendix D, we deeply explain the equations mentioned in this section.

Relevance Loss.

, F n ) = N a N p Np/Na i=1 k∈K k =k * log 2 1 + e -α(s Na,i (Fn,k * )-s Na,i (Fn,k)) , (8.4)
where s Na,i (F n , k) = Na j=1 F n t j+Na•(i-1) [f (x j , k)] defines the output score of the hypothesis k ∈ |K| for a given plaintext (x j ) 1≤j≤Na while α approximates the sigmoid function needed for estimating the success rate. Minimizing Equation 8.4 tends to maximize the mutual information M I(F n ; Y ) through the minimization of the error induced by Pr[Y |F n ]. In other words, we want to penalize a model F n when the correct label Y is not ranked as the highest hypothetical class. This penalization term is monitored by the distance between the score associated with the correct label Y and the other hypotheses. From a machine learning perspective, the maximization of M I(F n ; Y ) tends to generate compact clusters, one for each class. If False-Positives (FP) or False-Negatives (FN) appear during the training process, the ensemble model will be overconfident on its predictions and the resulted errors could be persistent. To reduce this effect, a solution is to provide diversity in order to limit the impact of these FP, FN examples. Hence, other empirical risks defined below bring more diversity during the training process.

Remark 8.3.1.1. The empirical risk combined with the relevant loss is actually the same as the ranking loss introduced in Definition 7.1.2.1. We reformulate it to facilitate the comprehension of the ensembling loss and the comparison with the mutual information ensemble diversity (see Definition 8.2.2.1) introduced by Brown [START_REF] Brown | An information theoretic perspective on multiple classifier systems[END_REF].

Conditional Redundancy Loss. The conditional redundancy M I(F n ; F m |Y ) quantifies the dependence between F n and F m given a set of labels Y . This mutual information helps the committee members to converge towards the correct label hypothesis with the same confidence. Maximizing M I(F n ; F m |Y ) is asymptotically equivalent to minimizing the error on Pr[F n , F m |Y ] which defines the probability of observing F n and F m given Y (see Appendix D). In other words, we want to minimize the distance between the scores of F n and F m given the correct class. Thus, given a profiling set I p of N p pairs (t i , y i ) 0≤i≤Np , a pair of parametric models (F n , F m ) and a number of attack traces N a such that N a |N p , we define the empirical risk combined with the Conditional Redundancy Loss function as:

R(L CRL , F n , F m ) = N a N p Np/Na i=1 -log 2 e -β|s Na,i (Fn,k * )-s Na,i (Fm,k * )| , ( 8.5)
where β is one hyperparameter that characterizes the impact of the distance on the penalization term and s Na,i (F n , k * ) defines the score related to the class k * given a set of N a traces and a parametric model F n . Through Equation 8.5, we want to penalize the learning process when the score s Na,i (F n , k * ) and s Na,i (F m , k * ) are different. Hence, we want to minimize the dissimilarity between the pairwise model F n and F m knowing Y . This will have the effect of increasing the confidence of the network on the True-Positive (TP) and True-Negative (TN) examples. Consequently, we consolidate the good predictions with more persistency. However, this loss does not interact with the False-Positive (FP) and False-Negative (FN) examples. The following redundancy loss reduces this gap.

Redundancy Loss. The redundancy M I(F n ; F m ) measures the pairwise dependence between all the committee members without considering the ground truth. A large mutual information induces a strong correlation among the pairwise committee members and promotes similarities which is not desired when we want to construct an efficient ensemble model. Hence, we want to minimize this mutual information to improve the ensemble performance (see Appendix D). The redundancy loss maximizes the distance between the score distribution of the models F n and F m . Therefore, we propose a loss penalizing the training process when this condition does not hold. Given a profiling set I p of N p pairs (t i , y i ) 0≤i≤Np , a pair of parametric models (F n , F m ) and a number of attack traces N a such that N a |N p , we define the empirical risk combined with the Redundancy Loss function as:

R(L RedL , F n , F m ) = N a N p Np/Na i=1 |K|-1 k=0 |K|-1 k =0 -log 2 1 -e -γ|s Na,i (Fn,k)-s Na,i (Fm,k )| , (8.6)
where γ is one hyperparameter that characterizes the impact of the distance on the penalization term.

Minimizing M I(F n ; F m ) is equivalent to maximizing H(F m |F n ). Consequently, we want to increase the uncertainty of F m given F n . Through the minimization of Equation 8.6, we promote the cluster scattering and reduce the global confidence of the committee members on the False-Positives and False-Negatives to decrease their persistency.

Ensembling Loss. We integrate the mutual information ensemble diversity during the training process to promote the diversity between the committee members.

, E) = 1 N c Nc-1 n=0 R(L ReL , F n ) + 2µ N c (N c -1) Nc-2 n=0 Nc-1 m=n+1 R(L RedL , F n , F m ) + R(L CRL , F n , F m ) ,
where µ quantifies the impact of the diversity term during the training process.

We normalize each term of the empirical risk to reduce the impact of exploding gradient. Appendix E highlights the benefits of each individual loss from a training perspective. Through this study, the reader can understand how the network would train if the conditional redundancy loss or the redundancy loss is individually used. Finally, in the following sections, the number of attack traces N a will be configured to 1 during the profiling phase as in Chapter 7.

Remark 8.3.1.2. Due to the wide range of hyperparameters (i.e. µ, α, β, γ), the empirical risk combined with the ensembling loss seems difficult to tune. From a practical perspective, these hyperparameters are dataset-dependent. Hence, it seems very challenging to define a generalized configuration for all types of implementations because it highly depends on the number of classes |K|, the noise induced in each trace, the implemented countermeasures and the targeted cryptographic algorithm implementation (e.g. AES, RSA, ECC). However, during our experiments, the tuning process was not a pitfall. Indeed, in the following section, α, β, γ values follow the strategy observed in Appendix B. Hence, they are configured in [0.001, 0.1]. In opposition, µ is not optimized in this manuscript and always equals 1.

Remark 8.3.1.3. As our framework is generic, we argue it is adequate to target private-key implementations, in particular AES and DES (i.e. |K| = 256). However, the training time increases exponentially with the number of output classes |K|. Hence, from a practical perspective, the application of the Ensembling Loss seems more suitable for low multiclass problems (i.e. |K| ≤ 5). This proposition fits with asymmetric algorithm implementations which consider low multiclass problems. Finally, even if this work is only focusing on the side-channel context, the Ensembling Loss can be used to solve any machine learning problems (i.e. image classification, image recognition, fraud detection, ...).

To validate the benefits of the ensembling loss, the following section investigates its impact on the ensemble diversity through a concrete example.

Enhancing the Features' Diversity

Diversity among the committee members is deemed to be a key issue in ensemble learning and should reduce the global error (see Subsection 8.2.1). In this section, we want to validate the theoretical observations provided in Subsection 8.3.1. Hence, we analyze the diversity evolution depending on the loss used during the training process. Three losses are considered in the rest of this chapter: the Negative Log-Likelihood, the Ranking Loss and the Ensembling Loss. All these learning metrics will be considered to select the most suited ensemble model such that three processes can be considered to perform the learning process:

• Independent Learning Strategy -There is no interaction among the committee members during the learning process. For example, each parametric model could be trained on different training set to reduce the features' correlation [START_REF] Breiman | Bagging predictors[END_REF]. Thus, they are independently obtained such that their posterior probabilities are combined once the learning process is fully performed on each committee member. This is the worst solution from the Type III diversity perspective;

• Sequential Training -This strategy induces a set of parametric models such that the learning process is sequentially performed on each committee member. This approach is suited as, at the n th iteration, the posterior probabilities obtained from parametric models (F i ) 0≤i<n can be used to penalize the learning process related to the parametric model F n ;

• Simultaneous Ensemble Learning -a set of committee members are trained interactively to promote uncorrelation and diversity during the learning process. This approach is the most natural solution to provide Type III diversity.

As the minimization of the empirical risk combined with the ensembling loss perfectly fits with the Simultaneous Ensemble Learning strategy, the rest of this chapter will be focused on this solution for allowing interaction between the committee members during the training process. Furthermore, it is helpful to promote the diversity between the members even if similar architectures are used. Assessing the benefits of the ensembling loss can be illustrated through the t-SNE visualization [START_REF] Van Der Maaten | Visualizing data using t-SNE[END_REF] and diversity measures [START_REF] Kuncheva | Measures of diversity in classifier ensembles and their relationship with the ensemble accuracy[END_REF].

Dataset setup for visualization. For that purpose, we use the secure RSA dataset presented in Section 3.6. As mentioned, the targeted index seg f ree value is defined in {0, 1, 2}. Consequently, to solve a classification task that assigns an index value to a leakage trace, we have to consider a multi-class classification problem with 3 outputs. Furthermore, the ensemble model is configured with 5 parametric models, as illustrated in Figure 8.1, such that each of them has the same neural network architecture. Generating 5 parametric models with the same architecture is helpful to efficiently evaluate the suitability of the ensembling loss in contrast with the negative log-likelihood and the ranking loss from a diversity perspective. These committee members are convolutional neural networks with 1 convolutional block based on 2 filters of size 1 and an average pooling layer with stride 2. Then, a flatten layer is applied to reduce the space dimension of the feature selection part. Finally, a predictive layer is applied with a softmax function. The optimizer hyperparameters are set such that each neural network is trained during 40 epochs, with a batch-size of 128, a learning rate set to 0.001 and the Adam optimizer [START_REF] Kingma | Adam: A method for stochastic optimization[END_REF].

Remark 8.3.2.1. A deeper investigation on the number of committee members is performed in Subsection 8.4.3 to evaluate its impact on the ensemble accuracy.

t-distributed Stochastic Neighbor Embedding [vdMH08]. Introduced by van der

Maaten and Hinton, the t-SNE visualization tool maps high-dimensional data into two-or threedimensional space while preserving local structure and revealing important global structure (e.g. clusters). t-SNE employs a nonlinear and iterative process to convert similarities between data points to joint probabilities and tries to minimize the KL-divergence between the joint probabilities of the low-dimensional embedding and the high-dimensional data. This representation is helpful to evaluate the ensemble model capacity to distinguish each class and validate the theoretical approach presented in Subsection 8.3.1. On the other hand, the ranking loss generates three separate clusters. As mentioned in Subsection 8.3.1, the ranking loss can be formulated as the relevance loss (see Equation 8.4). Through the minimization of this function, we aim at approximating the mutual information between a leakage trace T and a targeted label Y (see Subsection 7.2.1). In other words, we minimize the conditional entropy e H(Y |T ) which promotes the generation of three compact clusters. Figure 8.2 confirms this result as the ensemble model is overconfident in the features captured during the learning process. Consequently, it makes discriminative decisions to avoid connections between each cluster. However, following the t-SNE illustration, the FP and FN induced by the ranking loss are persistent and seem difficult to detect. Indeed, these errors are fully included in a wrong cluster. This result suggests that the ensemble model considering the ranking loss assigns a similar confidence to correct and wrong predictions. This phenomenon can be explained by the overfitting effect. Using more training examples could be useful to reduce this impact and reduce the error rate. However, when the number of profiling traces is limited (as often in practice), a solution has to be found to improve the ensemble model performance.

The best solution should create three separate clusters when the ensemble model is confident in its prediction while, the errors or the uncertain predictions should converge towards the equidistant point of the centroid of the clusters. These examples are called data uncertainty. Introduced in [START_REF] Malinin | Ensemble distribution distillation[END_REF], data uncertainty is the irreducible uncertainty in predictions which arises due to the complexity or noise in the data. In Figure 8.2, we can observe that the ensembling loss converges towards this best solution. Indeed, the combination of the relevance loss, the conditional redundancy loss and the redundancy loss creates three separate clusters (see Appendix E for deeper details). When the ensemble model is confident in its predictions, it will assign the related examples to the correct class. However, the ensembling loss creates some connections between the clusters which seem defined by the data uncertainty. This result tends to reduce the number of consistent FP and FN such that few errors can be detected on each cluster in contrast with the negative log-likelihood or the ranking loss. While the Evaluator's goal is to enhance the ensemble diversity, the t-SNE tool does not provide information related to this requirement. To validate the suitability of the ensembling loss regarding the evaluation perspective, we evaluate its diversity growth against the negative log-likelihood and the ranking loss.

Diversity Measures.

As explained in Subsection 8.2.1, diversity has a crucial impact on the ensemble model's performance. Conventionally the diversity measures can be decomposed into two categories:

• Pairwise measures that compute the relationship between two parametric models, and then average all the pairwise measurements to define the overall diversity of One advantage of pairwise measures it that they can be easily visualized and interpreted. Choosing a specific pairwise measure does not make significant difference in our experiments, so we chose the fraction of disagreement as well as the κ-statistic as they are relatively easy to interpret. Let N ab n,m be a joint value between two parametric models F n and F m . Given a leakage trace T, we denote a = 0 (resp. b = 0) if F n (resp. F m ) assigns a wrong prediction to T and a = 1 (resp. b = 1) otherwise. For example, N 01 n,m defines the number of elements such that F n provides a wrong prediction for a given input T while F m correctly predicts its related class. Definition 8.3.2.1 (Disagreement Measure [START_REF] Skalak | The sources of increased accuracy for two proposed boosting algorithms[END_REF][START_REF] Tin | The random subspace method for constructing decision forests[END_REF]). Given two parametric models F n and F m , the disagreement measure defines the proportion of inputs on which these parametric models make different predictions:

Dis(F n , F m ) = N 01 n,m + N 10 n,m N 11 n,m + N 10 n,m + N 01 n,m + N 00 n,m .
This metric is 0 when two functions are making identical predictions, and 1 when they differ on every single example in the test set. Hence, the larger the value, the larger the diversity. From an ensembling perspective, we want to generate a set of parametric models E maximizing the disagreement measure such that each individual model keeps a high performance for classifying unseen examples. In [FHL19], Fort et al. propose to plot a normalized disagreement measure with respect to the accuracy of each classifier. The diversity measure is normalized by the error rate to prevent the case where random predictions provide the best diversity. From the set of parametric models E, one member is randomly picked to be considered as the basis model. This model is denoted as F basis . Then, we calculate the diversity measure of other ensembling members against the basis model. Figure 8.3 illustrates the diversity of each model of E against F basis . In this figure, the y-axis characterizes the fraction of labels, returned by each model of E, which differs from F basis while the x-axis defines their validation accuracy. Consequently, the sample with a 0 y-axis value defines F basis . Three ensemble models are generated with the three losses used in order to investigate the benefits of the ensembling loss. In [FHL19], Fort et al. propose a theoretical approach to explain the results obtained in Figure 8.3. Let F basis and F n be two committee members from E. If F basis and F n have identical validation accuracy and high diversity then, they converge towards different local optimum with identical depth. In opposition, if F basis and F n have identical validation accuracy and a low diversity then, they converge towards the same local optimum. Consequently, from a loss landscape perspective, it sounds beneficial to construct an ensemble model with high diversity members such that their prediction distributions and their selected features differ from each other. In contrast, the accuracy of individual models does not reflect the performance of the ensemble committee. Indeed the combination of poor performance (i.e. weak), but perfectly complementary, parametric models can generate a very effective ensemble model. While the same configuration with effective, but correlated, parametric models is not beneficial for an ensembling approach (see Subsection 8.2.1). Consequently, an ensemble model composed by weak parametric models can outperform a combination of effective correlated models. The ensemble model trained with the ranking loss provides the worst diversity scenario. Even if individual parametric models are more efficient than most of the other committee members (i.e. validation accuracy > 94%), the lack of diversity is an issue for developing uncorrelated models. Indeed, following [START_REF] Fort | Deep ensembles: A loss landscape perspective[END_REF], all the committee members converge towards the same local optimum. Hence, a lack of complementarity can be exposed when the adversary only considers the ranking loss. Consequently, the resulted ensemble model performance should be equal to the average accuracy of its members. For the negative log-likelihood loss function, the parametric models are more diverse than the ranking loss ensemble model. Consequently, the resulted learners are less correlated and the resulted probability combination should reduce the overall error. Finally, in comparison with the negative log-likelihood and the ranking loss, the ensembling loss provides the most diverse models. Indeed, in Figure 8.3, the normalized diversity measure is the highest for the ensembling loss model. Interestingly, even if the committee members have the same architecture, the ensembling loss provides a clear diversity benefit. Hence, from a loss landscape perspective, the ensembling loss helps the committee members to converge towards independent local optimum with different depths. However, as Figure 8.3 only provides the disagreement measure between a model basis F basis and all parametric models of E, it does not provide the disagreement measure for all pairs (F n , F m ) in E. To mitigate this issue, we investigate the benefits of the κ-statistic metric to highlight the pairwise diversity induced in E.

Definition 8.3.2.2 (κ-statistic [START_REF] Cohen | A coefficient of agreement for nominal scales[END_REF]). The κ-statistic measures the degree of agreement between two parametric models F n , F m as follows:

κ(F n , F m ) = 2 N 11 n,m N 00 n,m -N 01 n,m N 10 n,m N 11 n,m + N 10 n,m N 01 n,m + N 00 n,m + N 11 n,m + N 01 n,m N 10 n,m + N 00 n,m .
This metric is 1 when F n and F m correctly/wrongly predict the same examples, and 0 when their predictions differ on every single example in the test set. Hence, the larger the value, the lower the diversity. Based on the parametric models used for visualizing the t-SNE embeddings (see Figure 8.2), we compute the κ-statistic metric for each scenario, i.e. application of the negative log-likelihood, the ranking loss and the ensembling loss. Figure 8.4 illustrates the evolution of this diversity metric depending on the loss used. When the ensembling loss is used, the overall κstatistic metric is reduced in comparison with the negative log-likelihood or the ranking loss. This figure confirms that the ensembling loss decorrelates the errors between the committee members. These observations validate the theoretical observations introduced in Subsection 8.3.1. Indeed, using the ensembling loss increases the diversity between the parametric models in order to reduce the correlation between their errors and propose an efficient ensemble model. In the next section, we evaluate this diversity gain on the side-channel attack performance.

A Case Study on Asymmetric Implementations

To assess the benefits of the diversity on the side-channel attacks targeting public-key implementations, we conduct investigations on two datasets:

• Secure RSA dataset -Introduced in Section 3.6, this dataset targets the manipulation of an index named seg f ree ∈ {0, 1, 2}. Thus, we have to solve a multiclass classification problem with 3 output classes. As this implementation considers a RSA signature computation with blinding countermeasure, the resulted exploitation phase considers N leakage traces.

• Secure ECC dataset -Defined in Section 3.6, the attack consists in retrieving all the conditional swap bits with a single leakage trace. Hence, we have to solve a binary classification problem such that the output classes denote the hypothetical value of one bit (i.e. 0 or 1).

As mentioned in Subsection 3.3.4 and Subsection 8.1.2, the Evaluator can consider the accuracy as metric performance.

Evaluation metrics. We denote α bit the accuracy expressing the capacity of the parametric model to retrieve the amount of correct bit values. Its related error rate is denoted bit . As this metric is natural to solve binary classification problems with a single leakage trace, the Evaluator can consider this evaluation metric to assess the suitability of a parametric model to defeat the Secure ECC implementations. However, when the Secure RSA dataset is considered, the Evaluator does not directly predict the bits related to the targeted private key. Indeed, he exploits the index seg f ree such that 3 values can be assigned. We denote α label the accuracy expressing the capacity of the parametric model to retrieve the correct value of seg f ree for a given leakage trace. This metric is used to mitigate the underfitting and overfitting issues. However, while the Evaluator's goal is to retrieve the bits related to the private key, he has to convert f the balanced ternary representation (i.e. {0, 1, 2}) into a binary representation (i.e. {0, 1}). We also use the notation α bit to denote the ability of the parametric model to retrieve the bits of the targeted private key.

Models' notation.

This section proposes an experimental comparison between the negative log-likelihood, the ranking loss and the ensembling loss when ensemble models are considered. Thus, in the following sections, N LL i,j (resp. RkL i,j , EL i,j ) denotes an ensemble model trained with the negative log-likelihood (resp. the ranking loss, the ensembling loss), composed by i committee members such that the type j diversity is performed. Due to the interactions between the committee members during the training process, the ensembling loss can be considered as the only learning metric promoting the type III diversity.

Remark 8.4.1. In the following, we only consider convolutional neural networks because its benefit has been demonstrated in the side-channel context (see Chapter 6). Obviously, the combination of diverse neural network (e.g. multi-layer perceptrons, fully-connected neural networks, recurrent neural networks, residual neural networks) can also be considered to promote diversity.

Application on N Traces Exploitation

First, we design the neural network architecture that we used to construct the ensemble model. This parametric model is repeated 5 times in order to constitute an ensemble E of 5 similar committee members. This approach is beneficial to evaluate the complementarity of committee members when the ensemble model is trained with the different losses. Then, we combine the type I diversity with the different learning metrics to illustrate its impact of the resulted performance. Finally, all the diversity types are combined to exploit the entire benefits of the ensemble methods and highlight the improvement in the resulted side-channel attack complexity.

Neural Network Architecture. While the original network provided in [CCC + 19] performs very well on the Secure RSA dataset (= 99.91%), we decide to reduce its complexity while preserving the performance. We use the methodology introduced in Subsection 6.3.1 such that the related neural network is composed of one convolutional block with 2 filters of size 1 and an average pooling layer. Then, a flatten layer is applied to connect the extracted points of interest to a predicting layer configured with 3 outputs defining the value of seg f ree . Optimization is done using the Adam optimizer [START_REF] Kingma | Adam: A method for stochastic optimization[END_REF] approach on a batch-size of 128 and the learning rate is set to 10 -3 . The batch-size and the learning rate follow the values provided in [CCC + 19]. The optimization of these hyperparameters is not considered in this study. We use the SELU activation function to avoid vanishing and exploding gradient problems (see Equation 4.8). In the following sections, we only keep the parametric model achieving its best performance (i.e. accuracy) over 100 epochs. This new parametric model has similar performance to the one proposed in [CCC + 19] (= 99.89%) while being much more efficient computational wise (i.e. 1, 950, 323 against 39, 015 trainable parameters). In this manuscript, we want to evaluate the suitability of the ensemble models when the number of profiling traces is limited (as often in practice). Hence, we only use 30, 000 profiling traces and 3, 000 validation traces instead of using the 750, 000 traces considered by [CCC + 19]. However, when the Evaluator trains a parametric model with the 30, 000 raw profiling traces of 13, 000 time samples, he already generates a classifier with very high performance (= 98.30%). Hence to efficiently evaluate the suitability of the ensembling loss, we add Gaussian noise N (0, σ 2 ) on each time sample of the leakage traces such that σ defines the standard deviation of the noise. Table 8.1 shows the evolution of the accuracy depending on the added noise on the Secure RSA dataset. In the following sections, σ is set to 6 in order to evaluate the benefits of the ensembling loss against the negative log-likelihood and the ranking loss. The model trained with the negative log-likelihood is considered as the state-of-the-art result because it uses the classical learning metric in the side-channel context. This result will be considered as our reference in order to highlight the performance provided by the ensembling loss. Learning ensemble diversity. To assess the diversity growth, we generate an ensemble model composed of 5 committee members with the same neural network architecture introduced in the previous paragraph. Consequently, the diversity provided by the following ensemble models only depends on the loss used. Table 8.3 illustrates the performance evolution depending on the diversity type and the learning metric applied. If the Evaluator only considers the state-of-the-art result, he trains a unique model with the negative log-likelihood (i.e. N LL 1 ) to perform its attack. However, when he applies the ranking loss function introduced in Chapter 7, the related attack performance is more efficient than the negative log-likelihood (see Table 8.3). While a parametric model obtained from the minimization of the empirical risk combined with the negative log-likelihood does not provide a useful model from the Evaluator's restrictions (i.e. C {N C,2 b ,AA} ≥ 100), using the ranking loss the Evaluator can potentially break the Secure RSA implementation (i.e. C 2 b ≤ 100). Finally, we can observe a meaningful improvement when the ensembling loss is performed on the 5 committee members defined in E. Even if the training time is multiplied by 9 in the worst case, it stays reasonable from a practical perspective. Indeed, α label is increased by up to 2.69% and the Evaluator can extend its attack scenario. Following the SOG-IS recommendations, he can successfully perform an alternate attack while the state-of-the-art (i.e. N LL 1 ) result cannot. This result highlights the benefit of using the ensembling loss in terms of ensemble performance. In addition, considering the ensembling loss reduces C 2 b by 25. Hence, the theoretical features of the ensembling loss, which are validated through the visualizations of Subsection 8.3.2, translate an actual gain in model accuracy as well as a realistic improvement for a full sidechannel attack scenario. The ensembling loss increases the overall diversity and reduces the global error rate induced in the ensemble model. Hence, the ensembling loss is helpful to promote the complementarity between the committee members. bits while the least significance one finds only 88.21% of all bits. The interaction between the committee members during the training process tends to accentuate the discrepancy in order to force the gain in diversity. Table 8.3 illustrates the benefits of combining the type I diversity with the ensembling loss from a performance perspective. Adding type I diversity reduces the remaining attack complexity regardless of the attack scenario. Combining all types of diversity. Introduced in [LWC + 19], the type I+II diversity consists of the selection of members from a pool such that the diversity measure is maximized between all the committee members. These parametric models are selected by randomly picking out the hyperparameters from ranges defined in Table 8.2. The resulted pool is composed by 100 members. As recommended in [LWC + 19], we retain a set of parametric models with high performance g (i.e. α label > 85%) such that their disagreement measure is maximized. The 5 selected neural network architectures are identified in Appendix F Table F.2. The type I+II diversity promotes the error uncorrelation between the individual committee members. Following the κ-statistic measure (see Figure 8.5), the diversity brought by the type I+II is significant in comparison with the previous experiments. Indeed, the overall κ-statistic measure is reduced in comparison with the other approaches. This observation can also be made with the disagreement measure (see Figure 8.6).

g In some cases (e.g. boosting [START_REF] Chen | Xgboost: A scalable tree boosting system[END_REF]), weak learners (i.e. models that are only slightly better than random guessing) can be helpful to increase the performance of the ensemble model. The benefit of these strategies is considered as out of our scope. When the ranking loss or the negative log-likelihood is considered, even if no interaction is proposed between the committee members during the training process, using the type I+II diversity is useful to bring more diversity in the ensemble model. However, combining the type I+II diversity with the ensembling loss accentuates the gain in diversity in order to generate a more powerful model. From Table 8.3, we observe a significant improvement when the ensembling loss is used in comparison to the ranking loss and the negative log-likelihood. Generating interactions between the committee members provides more consistency during the training process. As mentioned in Subsection 8.3.2, the ensembling loss leads to converge the uncertain predictions towards the equidistant point of the centroid of the clusters. Thus, the impact of the FP and FN is reduced when this loss function is performed. Combining all the diversity techniques provides the most efficient model in terms of performance. While an ensemble model trained with the ranking loss needs 2 56 operations to retrieve the remaining bits in the best-case scenario, the addition of the ensembling loss with the type I+II diversity needs only 2 34 operations. Even if the resulted training time is multiplied by 3, the gain in performance is significant to justify the benefits of the ensembling loss. In conclusion, combining all the diversity techniques provides a clear advantage from a side-channel point of view. Indeed, when the type I+II diversity techniques are combined with the ensembling loss (i.e. type III diversity), we promote the diversity between the parametric models included in E in order to reduce the global error. In comparison with the previous state-of-the-art result (i.e. N LL 1 ), α bit is increased by 6.8% and the number of remaining operations is reduced by 2 290.56 (resp. 2 74 and 2 22.03 ) when the adversary wants to perform a naive attack (resp. a 2 b -attack and an alternate attack). Even if the training time is increased by up to 39.44, it stays negligible regarding the gain to perform the full attack. Indeed, following the SOG-IS recommendation and the Evaluator's restrictions (see Subsection 8.1.1), the previous state-of-the-art result considers the RSA implementation as secure while combining the different diversity techniques leads the Evaluator to reconsider its security assessment.

While the Evaluator has to deal with different attack scenario, we extend the application of the diversity approach on the Secure ECC dataset that requires a single leakage trace to retrieve all the private key bits.

Application on 1 Trace Exploitation

To emphasize the benefits of the ensembling loss, we evaluate its suitability on a classical binary classification problem. While the secure RSA dataset can be defined as a multi-class classification task (3 outputs), we perform the same experimental process on the Secure ECC dataset. Note that remaining brute-force attacks that require N a exploitation traces, such as [START_REF] Schindler | Power attacks in the presence of exponent blinding[END_REF], cannot be used in this context.

Neural Network Architecture. Similarly to the secure RSA dataset, we have to add Gaussian noise N (0, σ 2 ) to characterize the benefits of the ensembling loss. Table 8.4 shows the evolution of the accuracy depending on the added noise and the loss used when 20, 000 profiling traces are used. To evaluate the suitability of each network, 2, 000 validation traces are considered and the evolution of the accuracy is used to limit the overfitting/underfitting effect.

For our analysis, we set the added noise to σ = 30. Once again, we clearly evaluate the benefits of the ranking loss when the added noise is high in comparison to the negative log-likelihood loss function. Indeed, we increase by up to 3.5% the resulted performance. Ensemble diversity. First, we validate the theoretical observations provided in Subsection 8.3.1 for the binary classification problem. For that purpose, we visualize the t-SNE maps for the models trained with the different losses. Figure 8.7 confirms all the theoretical results introduced in Section 8.3. The negative log-likelihood representation does not seem relevant to efficiently discriminate each cluster. The resulted ensemble model seems to select joint patterns such that many FP and FN can deteriorate the overall performance. In opposition, the model trained with the ranking loss creates compact clusters such that the false positives and false negatives can be considered as consistent. Finally, from a theoretical perspective, the ensembling loss seems the most suitable. Indeed, the data uncertainty seems to converge towards the equidistant point of the centroid of the clusters. Hence, the resulted ensemble model tends to gather the uncertain examples towards a uniform probability distribution. Furthermore, using the ensembling loss provides a clear benefit from a diversity perspective (see Figure 8.8). Through Table 8.5, we confirm the benefits of the ensembling loss for increasing the performance of the ensemble model. In comparison with the previous state-of-the-art result (i.e. N LL 1 ), the accuracy expressing the performance to retrieve the conditional swap bit value is increased by 6.5% when the ensembling loss is combined with the type I and II diversities. From a side-channel attack perspective, we reduce the overall number of remaining operations by 2 58.41 (resp. 2 16 ) for naive attack (resp. 2 b -attack). Hence, using the ensembling loss against a binary classification problem still performs well. From a naive attack perspective, an adversary using the previous state-of-the-art result (i.e.

N LL 1 ) considers the ECC implementation as secure following the SOG-IS's recommendations (C N C > 100). However, if the Evaluator combines all the diversity types, including the ensembling loss, he can reconsider the security of the targeted device.

Discussion

This discussion evaluates the classical ensemble methods (i.e. Bagging [START_REF] Breiman | Bagging predictors[END_REF], Boosting [START_REF] Freund | Experiments with a new boosting algorithm[END_REF][START_REF] Chen | Xgboost: A scalable tree boosting system[END_REF]), the parametric model fusion's techniques (i.e. average accuracy, voting) and the impact of the number of committee members.

Ensemble Methods. Remark 8.4.3.1. The ensembling loss cannot be considered when the bagging technique is applied. Indeed, given a profiling set T , the N p pairs ((t i , y i ) 0≤i<Np ) should be the same for all the committee members when the ensembling loss is computed. This condition is a limitation regarding the application of the bagging algorithm.

Combination Methods. One major issue when ensemble model is considered is to find the best way to combine the posterior probabilities of each committee member. There are several consensus methods for combining the outputs of multiple learners. We compare the two most useful combining methods:

• Averaging -This consensus is considered as a linear combining method. The average prediction returned by the committee members is computed. An advanced combination technique consists of weighting the average of each classifier to promote the order of the classes. However, this method stays out of our scope.

• Voting -This method is considered as a non-linear decision-making based on ranked information. The majority voting process predicts the value with the highest number of occurrences. Hence the collective decision has a major impact on the final prediction. These results shown in Table 8.7 are closely correlated with those defined in the previous sections. Hence, for the experiments investigated in this chapter, these aggregating functions do not impact the performance of the ensemble model.

Number of Committee Members.

The number of committee members can also be considered as an issue in ensemble methods. Indeed, no useful methods define a priori the best number of committee members that maximize the ensemble model performance. In the following, we explore this variable in order to identify its impact on the ensembling loss performance. To that purpose, we increase the number of committee members up to 32 in order to evaluate the gain in performance and the impact on the training time. Through Table 8.8, we can estimate the best trade-off between the training time and the ensemble performance. For the RSA implementation, the best α bit value is obtained for N = 10 committee members. While increasing the number of members seems helpful to improve the ensemble model's accuracy, in our context we seem to reach the maximal possible performance. Adding too many learners can reduce the diversity effect because some committee members can share the same errors and promote irrelevant outputs. Furthermore, as illustrated in Figure 8.9, adding committee members in E increases the computational complexity of the ensemble model and, consequently, the elapsed time criterion. As no general consensus can be formulated, the best number of committee members should be defined for each case study.

Conclusion

This chapter proposes to deal with the Evaluator's restriction when he has to perform an attack against an asymmetric cryptographic implementation. In this context, the Evaluator has to maximize the accuracy of retrieving each secret bit of the targeted private key such that, a slight improvement can be non-negligible from a side-channel attack complexity perspective.

A classical solution to enhance the performance of the deep learning approach consists in combining individual predictions from several parametric models via a consensus method (e.g. majority vote, average vote) in order to reduce the global error. This error reduction is known to be correlated with the parametric model's diversity. Following the work provided in [LWC + 19], we describe three types of diversity and assessing their suitability to perform a side-channel attack under the Evaluator's restriction. To enhance the evaluation of the robustness of cryptographic module, we develop a new loss, namely the Ensembling Loss, that increases the performance of ensemble models. Promoting the interactions between the committee members during the training process, this loss increases the resulted diversity to reduce the correlation between the errors induced by the committee members. First, we link this new learning metric with the mutual information between the ensemble model and its related label introduced by Brown in [START_REF] Brown | An information theoretic perspective on multiple classifier systems[END_REF].

Then, through the disagreement measure and the t-SNE visualization, we show that ensemble models trained with the Ensembling Loss increase the diversity between the committee members.

To assess the benefits from a side-channel perspective, we evaluate the accuracy growth on the remaining attack complexity through multiple attack scenarios, namely Naive Attack, 2 b -Attack and Alternate Attack. This investigation shows that applying deep learning-based side-channel attacks can be unadapted to defeat secure RSA/ECC implementations if the previous state-of-the-art is considered (i.e. a single model trained with the negative log-likelihood loss function). Following the SOG-IS security guidances, the improvement provided by the combination of different types of diversity lead to a reconsideration of the targeted system's security.

Furthermore, considering the Ensembling Loss outperforms all the current learning metrics classically used in side-channel analysis. Hence, this loss could be considered for generating efficient ensemble models.

Chapter 9

Conclusion & Perspectives

In this thesis, we focused on several current issues related to the deep learning-based side-channel attacks, developing new neural network architectures in order to fit with the Evaluator's restrictions as well as proposing new learning metrics for converging towards the optimal Adversary. In this chapter, we conclude the contributions made in this manuscript according to two issues: (i) the problem of modeling Side-Channel Attacks and (ii) the ability of the resulted models to converge towards the optimal Adversary. For each of these two parts, we provide a summary of the related contributions and discuss some perspectives arising from the results obtained. Generative models. To bridge the gap between Deep Learning and Side-Channel Analysis, we describe a new generative model based on one of the most generic profiled attacks namely stochastic attack. Through our investigations, we emphasize the similarities with the conditional variational autoencoder and develop a new neural network architecture which derives from the stochastic attack scenario. Through this approach, we approximate the targeted leakage model ψ and emphasize the ability of the cVAE-ST to correctly assess the robustness of a cryptographic module against side-channel attacks. Furthermore, in order to reduce the black box issues, some visualization techniques are employed in order to assess the security flaws induced in the targeted cryptographic module. Through this approach, the Evaluator can alert the Developer on potential vulnerabilities and ease the development of adapted countermeasures. However, even if these promising results suggest that generative models are suitable to perform side-channel attacks, some perspectives can be highlighted in order to enhance the state-of-the-art result. Indeed, an open question relates to the ability of the cVAE-ST to efficiently prevent, or at least mitigate, the countermeasures classically considered by the Developer namely data randomization and hiding countermeasures.

Perspective 9.1.1 (Hiding countermeasure). Assessing the benefits of some neural cVAE-ST properties to mitigate the hiding effect while preserving its interpretability and explainability.

Perspective 9.1.2 (Dimensionality reduction). Finding a dimensionality reduction technique in order to focus the latent space V on informative time samples ( i.e. points of interest) while preserving the interpretability and explainability of cVAE-ST.

A first step to enhance the state-of-the-art results consists in adding convolutional blocks as mentioned in Subsection 5.4.2. Indeed, regarding the result obtained from the discriminative models, the convolutional blocks can be useful to reduce the leakage trace dimension as well as mitigating the desynchronization effect. The Evaluator can add those blocks to the encoder in order to preprocess the leakage traces before the estimation of the true unknown leakage model ψ. However, even if this solution can be suited for mitigating hiding countermeasures as well as reducing the dimensionality of the leakages, some verification should be made in order to assess the loss of interpretability and explainability. Furthermore, in the black-box context, the Evaluator needs to exploit joint distribution of leakages in order to exploit information that depend on two unknown random variables X and Y (e.g. plaintext, output of the Sbox) [START_REF] Linge | Using the joint distributions of a cryptographic function in side channel analysis[END_REF][START_REF] Clavier | Improved blind side-channel analysis by exploitation of joint distributions of leakages[END_REF]. In this scenario, the Evaluator has to deal with a blinded environment such that, he does not know the variables manipulated by the cryptographic module. This approach is similar to the Unsupervised learning approach. As mentioned in Subsection 5.1.3, the generative approach can be useful to solve such problems and computing Pr[k|X, Y ] which denotes the probability of observing a given key hypothesis k ∈ K knowing the random variables X and Y .

Perspective 9.1.3 (Blind Side-Channel Attacks). Assessing the suitability of generative models to conduct Blind Side-Channel Attacks.

This direction can then be extended to the non-profiled side-channel attacks.

Discriminative models. As demonstrated by Cagli et al. [START_REF] Cagli | Convolutional neural networks with data augmentation against jitter-based countermeasures -profiling attacks without pre-processing[END_REF], the convolutional neural networks are highly beneficial to mitigate the hiding countermeasures. In Chapter 6, we validate this observation by investigating the impact of some model's hyperparameters, namely filter size, pooling operation as well as the number of convolutional blocks. For example, Cagli questions the feasibility of using Siamese Neural Networks in order to perform collision attacks [START_REF] Cagli | Feature Extraction for Side-Channel Attacks[END_REF]. Perform HO-SCA without preprocessing

In addition, [Mag20, ZXF + 19] introduce multi-task learning in the side-channel context. This approach targets simultaneously multiple intermediate sensitive variables, subparts of the secret key, or the binary representation of a given byte. The latter solution sounds highly beneficial to conduct future works. Indeed, given a word of n bits, the Evaluator can design a neural network with n outputs such that each of them is associated with a bit of the targeted word. Thus, given a leakage trace T which captures the consumption related to this n-bit word, the Evaluator can assign to it n labels. Applying the multi-task learning approach to such problem is useful as the learning metrics assess the ability of the neural network to retrieve each bit of the word. Consequently, the Evaluator can define a confidence level, characterized by a threshold, such that, each bit with a score higher than this threshold is considered as a certain prediction implies that the prediction is considered certain. Based on those certain bits, the Evaluator can reduce the number of n-bit key candidates for a set of leakage traces. Furthermore, using the Ensemble approach introduced in Chapter 8 should be highly beneficial in this context if the Evaluator combines neural networks with different levels of certainty on bit predictions.

Perspective 9.1.5 (Multi-Task Learning). Assessing the benefits of the multi-task learning approach in order to target n-bit words such that n > 8.

For example, if the Evaluator targets an n-bit data bus where the secret key transits (e.g. the bus between the microprocessor and the memory), he can use the multi-task learning approach in order to simultaneously target each bit of the secret key. Then, based on the score related to each bit, he expects to reduce the space of hypothetical keys in order to perform a practicable attack.

Hybrid discriminative-generative model. In Part II, we analyze the benefits and the limitations of the cVAE-ST and the discriminative approach. Regarding the needs of the Evaluator (i.e. interpretability, mitigating hiding countermeasures, points of interest selection and performing HO-SCA a without any preprocessing), we observe that both approaches are complementary (see Table 9.1). Furthermore, following [START_REF] Lasserre | Hybrids of generative and discriminative methods for machine learning[END_REF], one interesting property of the generative models is that they independently learn each category (i.e. dependencies for a given label). Thus, if the Evaluator wants to add one class to a given generative model, he keeps the one already trained and just performs an additional learning phase for the new category. In opposition, for a discriminative model, the Evaluator has to start the learning process from scratch if an additional category (e.g. class) is added to the model. Thus, considering the generative approach provides a more flexible solution from an evaluation point of view. Moreover, following Chapter 5, the Evaluator can use the cVAE-ST to retrieve an interpretable (Θ, φ)-parametric model F Θ,φ but cannot perform HO-SCA without preprocessing phase. In order to automatically find a combining function defeating Boolean masking implementation, the Evaluator can consider the discriminative models as illustrated over Chapter 6. Thus, the Evaluator can question the feasibility of combining both approaches in order to preserve all the benefits introduced in Table 9.1.

In opposition to the Generative Adversarial Network (GAN) which can be considered as a Generative-Discriminative model b , our perspective suggests designing a Discriminative-Generative model.

a This term refers to the High-Order Side-Channel Analysis described in Section 3.5 b During the training process, a GAN aims at finding the generative model's configuration such that the discriminative model cannot differentiate a fake data from a real one.

Perspective 9.1.6 (Discriminative -Generative Model). Designing a Discriminative -Generative model such that the Discriminative model automatically finds the best combining function while the cVAE-ST aims at identifying some dependencies between the leakage trace and the targeted unmasked variable Y .

Through this approach, the Evaluator keeps the interpretability induced by the cVAE-ST model while defeating Boolean masking implementation at least. Considering this approach can be highly beneficial from an evaluation point of view because the elapse-time criterion can be drastically reduced if a deterministic solution exists to construct the discriminative model. This perspective needs to develop a new paradigm in order to reduce even more the gap between Deep Learning and Side-Channel Analysis fields.

On the other hand, this manuscript covers the optimal adversary's topic. The following section summarizes the contributions that have been made and it proposes some perspectives in order to enhance the attack performance.

Converging Towards the Optimal Adversary

The second part of this manuscript focuses on reducing the errors induced in Θ-parametric functions F Θ . In particular, we reduce the gap between Deep Learning and Side-Channel Analysis by designing new loss functions that reduce the error induced by individual and collective Θparametric functions.

Learning metric. While classical DLSCA considers the negative log-likelihood loss function as suited to conduct the training process, we suggest an alternative, namely Ranking Loss, in order to reduce the gap between Machine Learning metrics and those introduced in side-channel context. Through this investigation, we highlight the correlation between the side-channel context and the learning to rank paradigm such that minimizing the ranking loss is beneficial to maximizing the Success Rate of a given neural network. This result suggests that a model trained with the ranking loss aims at retrieving the trainable parameters Θ that fit with the Optimal Adversary introduced in Objective 3.3.1.1. This new learning metric prevents the approximation error and performs, in the worse case, similarly to a parametric function F Θ selected from the minimization of the empirical risk considering the Negative Log-Likelihood loss function. When the Evaluator trains a neural network, he generally computes Equation 7.5 such that N a = 1. In other words, he wants to select the Θ-parametric function F Θ that performs the best when a single leakage trace is considered during the attack phase. However, if N a > 1, the Evaluator can aggregate the score s Na,i (F Θ , k) for each key hypothesis k ∈ K and update the trainable parameters Θ accordingly.

Perspective 9.2.1 (Configuration of the Ranking Loss with N a > 1). Assessing the benefits of using N a > 1 leakage traces during the training phase when the ranking loss is considered and evaluating the benefits and the limitations both from a practical and a performance perspective.

If this perspective eases the evaluation of the underfitting and overfitting issues on trivial scenarios, the Evaluator can question the feasibility of defining a bound on N a following the SNR computation as suggested in [START_REF] Maghrebi | There is wisdom in harnessing the strengths of your enemy: Customized encoding to thwart side-channel attacks[END_REF] for the CPA attack. It can be highly beneficial to perform Early Stopping techniques based on the learning metrics without having to perform a full attack [RZC + 21]. On the other hand, Perspective 9.1.6 suggests the need of a new loss function in order to deal with the hybrid discriminative-generative model. Perspective 9.2.2 (Loss function for Discriminative -Generative Model). Identifying a loss function which automatically finds a combining function that maximizes its dependency with the targeted variable Y such that the generated leakage trace T, induced by the cVAE-ST, optimizes its similarity with the combined leakage trace.

Finding such solution can be helpful to combine the benefits of both approaches namely interpretability and HO-SCA. The optimal goal of this research direction consists in finding a model fully interpretable and explainable from a side-channel perspective such that HO-SCA can be performed while facilitating the design of a suitable neural network based on the theoretical investigations provided in Chapter 5.

Uncertainties.

To converge towards the Optimal Adversary, we also demonstrate the benefits of combining the probability distributions provided by multiple parametric models in order to reduce the global error induced in an ensemble model (see Chapter 8). More precisely, we design a new loss function, namely Ensembling Loss, in order to promote interactions between the parametric models during the training process such that correlated errors are penalized. Constructed from the mutual information between an ensemble model and the targeted sensitive variable, this loss function is beneficial to differentiate certain from uncertain predictions. This eases the location of uncertain bits and thus, promotes a full attack scenario (i.e. retrieving all the private key bits) against asymmetric cryptographic implementations. However, to capture differentiation between certain and uncertain predictions, the ensembling loss is confronted to the ability of the Evaluator to design suitable neural network architectures. If the parametric models are not suitably configured, the uncertain bits can be difficult to locate.

Perspective 9.2.3 (Number of Remaining Operations). Locating the uncertain predictions in order to reduce the number of remaining operations and enhance full attack scenarios against asymmetric cryptographic implementations. Some methods have been investigated in the Machine Learning field in order to reduce the risks of wrong diagnosis in personalized medicine or meteorological forecasting. First, the Calibration method [KLM19] converts the scores c assigned to each bit into frequentist reading. In other words, the bits with a calibrated probability of p should have an observed frequency of belonging to the correct class to be precisely p. Thus, this approach can be highly beneficial to define the score threshold such that all the bits over this score are perfectly predicted. On the other hand, the Conformal Prediction [START_REF] Cauchois | Knowing what you know: valid and validated confidence sets in multiclass and multilabel prediction[END_REF] produces error bounds around the scores assigned to each private key bit in order to define a confidence interval. Based on those techniques, the Evaluator can reduce the number of remaining operations and eases the application of a full attack scenario against asymmetric cryptographic implementations.

Mitigating the desynchronization effect. As mentioned in Chapter 6, the convolutional neural networks are useful to defeat hiding countermeasures. However, through our investigations, we observe that dealing with such countermeasures make the design of a Θ-parametric function F Θ more complex. As the model hyperparameters space increases with the complexity of the neural network architecture, the elapsed time criterion can be impacted during the evaluation of a targeted cryptographic module. Furthermore, in [START_REF] Zhou | Deep learning mitigates but does not annihilate the need of aligned traces and a generalized ResNet model for sidechannel attacks[END_REF], Zhou and Standaert suggest that the Evaluator needs to use alignment methods in order to preprocess the leakage traces and ease the exploitation of security flaws. The results obtained in Chapter 6 are consistent with this observation.

Perspective 9.2.4 (Automate the synchronization process). Finding solutions that automate the alignment process in order to ease the construction of the neural network architecture and optimizing the elapsed time criterion.

A solution, proposed in [SWES + 19], consists in automatically learn a non-linear time warping that can be applied on unseen leakage traces. Even if the Evaluator can question the benefits of this approach to prevent or mitigate the hiding countermeasures classically implemented by the Developer without any loss of information, using Deep Learning techniques on synchronized leakage traces ease non-negligibly optimization process. • Scenario 4 -We assume that each leakage trace is configured by 3 time samples such that only 1 point of interest is considered. The leakage model does not induce interactions between bits (i.e. d = 1 and G 2 ) such that all bits influencing the leakage model have different weighting. Hence, the i th time sample of the simulated trace t is defined as follows:

T[i] =    1 • Y [3] + 0.5 • Y [6] + Z[i] if i = 1, Z[i] otherwise,
where

Y [b] = Sbox[X ⊕ k * ][b]
and Z[i] is a Gaussian noise following N (0, σ 2 ) such that σ 2 ∈ {0.1, 1, 10}.

Different levels of noise are considered for all scenarios in order to get an overview into how cVAE-ST performs depending on the SNR result (see Table A.1). Whatever the scenario, the cVAE-ST can retrieve the leakage model (see Hence, the cVAE-ST can be used to evaluate the security flaws when large bits' interactions are observed, when the deterministic part is different for all PoIs and when different weighting occurs. As a consequence, large use-cases can be considered when the cVAE-ST is applied. However, for a high level of noise, the extraction of the leakage model becomes more difficult. To retrieve the leakage model, the evaluator has to increase the number of profiling traces in order to reduce the noise effect. While the impact of the noise highly depends on the underlying implementation, no general rules can be formulated to predefine the number of profiling traces that are needed for a given level of noise. However, from a computational perspective, a large gap between s Na,i (F n , k * ) and s Na,i (F m , k * ) can be problematic to solve Equation D.8 as the exponential value converges quadratically towards 0. To reduce this issue, we simplify the distance measurement such that the empirical risk combined with the conditional redundancy loss function can be written as follows: given a profiling set I p of N p pairs (t i , y i ) 0≤i≤Np , a pair of parametric models (F n , F m ) and a number of attack traces N a such that N a |N p , we define the empirical risk combined with the Conditional Redundancy Loss function as: Approximation of M I(F n ; F m ). The mutual information M I(F n ; F m ) is used to compute the redundancy term (i.e.

Nc-2 n=0

Nc-1 m=n+1 M I(F n ; F m )) such that, following Equation D.1 and Equation D.2, we want to minimize the probability of observing F n knowing F m . Following the discussion provided on the conditional redundancy loss, we have to maximize the dissimilarity between F n and F m . If F n : T → S and F m : T → S, such that S ⊆ R |Y| , we want to find a solution that maximizes Pr[s Na,i (F n , k) = s Na,i (F m , k )] for each pair (Y k , Y k ) (k,k )∈K×K such that Y k = f (X, k) (resp. Y k = f (X, k )) for a given plaintext X, a cryptographic primitive f and a key hypothesis k (resp. k ). As Pr[s Na,i (F n , k) = s Na,i (F m , k )] = 1 -Pr[s Na,i (F n , k) = s Na,i (F m , k )], we can reuse the results obtained from the conditional redundancy loss in order to compute a partial redundancy loss, denoted L (p) RedL , such that:

L (p)
RedL (F n , F m , k, k ) = -log 2 1 -e -γ|s Na,i (Fn,k)-s Na,i (Fm,k )| , where γ is one hyperparameter that characterizes the impact of the distance on the penalization term. Then, as the partial redundancy loss function L (p) RedL (F n , F m , k, k ) has to be performed on each pair (k, k ) ∈ K × K, it is possible to generalize the result to compute the resulted empirical risk. Indeed, given a profiling set I p of N p pairs (t i , y i ) 0≤i≤Np , a pair of parametric models (F n , F m ) and a number of attack traces N a such that N a |N p , the empirical risk combined with the Redundancy Loss function can be defined as: log 2 1 -e -γ|s Na,i (Fn,k)-s Na,i (Fm,k )| .

Approximation of the pairwise mutual information ensemble diversity. Based on Equation D.1, we can introduce a new empirical risk that maximizes an approximation of the mutual information between a set of parametric models E = {F 0 , F 1 , • • • , F Nc-1 } and a targeted information Y . Indeed, given a profiling set T of N p pairs (t i , y i ) 1≤i≤Np and a number of attack traces N a such that N a |N p , we define the empirical risk combined with the ensembling loss function as:

  Secure communication using a symmetric algorithm. . . . . . . . . . . . . . . . . . 1.2 Structure of AES. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3 Digital signature mechanism. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.4 Example of the French Certification Process with Thales considered as the ITSEF. 1.5 Position of Deep Learning-based Side-Channel Analysis regarding Artificial Intelligence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.6 Evolution of the number of DLSCA papers released (April 21 st , 2021). Among the papers we report, only 18% include a GitHub repository. . . . . . . . . . . . . . . 2.1 L p -norm visualization for two dimensional vector such that ||x|| p = 1. . . . . . . 3.1 Structure of a CMOS inverter. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 Measurement setup to acquire power consumption and electromagnetic emanations. 3.3 A power consumption of an AES-128 encryption. . . . . . . . . . . . . . . . . . . 3.4 Leakage assessment of AES-128 encryption function. . . . . . . . . . . . . . . . . 3.5 Simple Power Analysis (SPA) (k * = 0100101001011101). . . . . . . . . . . . . . . 3.6 Scenario of a differential side-channel attack (DSCA). . . . . . . . . . . . . . . . . 3.7 Partial security graph resulting of a CPA which targets one byte of an unprotected AES-128 with known inputs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.8 Example of 1 st -order Boolean masking scheme. . . . . . . . . . . . . . . . . . . . . 3.9 ChipWhisperer dataset. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.10 DPA contest-v4 dataset. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.11 AES_HD dataset. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.12 AES_RD dataset. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.13 ASCAD dataset. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.14 Secure RSA dataset. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.15 Secure ECC dataset. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.16 Scenario of a side-channel analysis. . . . . . . . . . . . . . . . . . . . . . . . . . . 4.1 Evolution of the Risk over the Model space complexity. . . . . . . . . . . . . . . . 4.2 Example of underfitting -overfitting effect on a binary classification task. . . . . . 4.3 Geometric interpretation of regularizer using L 1 -norm and L 2 -norm with ||F Θ || p ≤ α constraint which minimizes the empirical risk represented by the solid ellipses. The optimal RERM solution is defined by Θ * but can lead to overfitting issues. . . 4.4 Graphical representations of diverse functions considering the neural network structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.5 Graphical representations of diverse architectures classically considered in deep learning-based side-channel attacks. . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6 Example of computations performed in a convolutional block. . . . . . . . . . . . 4.7 Evolution of the gradient descent algorithm (red line) on a two-dimensional loss landscape's projection of a parametric model F Θ with Θ = [θ 0 , θ 1 ]. . . . . . . . . . 4.8 Scenario of a deep learning-based side-channel analysis. . . . . . . . . . . . . . . . xv xvi LIST OF FIGURES 5.1 Simulation of a linear leakage model ψi,α characterized by Equation 5.2 such that the weighting is similar for all (α j [i]) 0≤j<8 . The red points define the real unknown leakage model ψ i while the blue points denote a sampling coming from the distribution of T[i] for 200 leakage traces. . . . . . . . . . . . . . . . . . . . . . . 83 5.2 Taxonomy of Generative Models. . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 5.3 cVAE-ST structure, considering D = D = 2, where D KL (Pr [V|T, Y, Θ] ||Pr [V]) (resp. E v∼F (enc) Θ -log (Pr [T|Y, v, φ])) denotes the loss introduced in Subsection 5.2.3 namely KL-divergence loss (resp. the reconstruction loss). . . . . . . . . . . . . . 91 5.4 Weight visualization assessing the suitability of our generative model to retrieve the leakage model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 5.5 Weight visualization for assessing the suitability our generative model to simultaneously target multiple intermediate values (see Equation 5.17). . . . . . . . . . . 101 5.6 Weight visualization of 50 time samples assessing the suitability of our generative model to retrieve the leakage model. . . . . . . . . . . . . . . . . . . . . . . . . . 104 6.1 Methodology for weight visualization ((a) -concatenation of each intermediate trace following their temporal axis ; (b) -computation of Θ[0] to get a temporal correspondence). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 6.2 Heatmap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 6.3 Convolution operation between a ChipWhisperer leakage trace T and a filter W Θ of size n ((a) -a leakage trace; (b) -zoom on a leakage trace's portion which includes points of interest that are characterized by red crosses; (c) -Heatmap between T and W Θ ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 6.4 Impact of the filter length on the weights Θ introduced in Equation 6.2. . . . . . . 117 6.5 Impact of the number of convolutional blocks on the weights Θ introduced in Equation 6.2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 6.6 Evaluation of the DPA contest-v4 dataset. . . . . . . . . . . . . . . . . . . . . . . 122 6.7 Evaluation of the AES_HD dataset. . . . . . . . . . . . . . . . . . . . . . . . . . 123 6.8 Evaluation of the ASCAD dataset with no desynchronization. . . . . . . . . . . . 124 6.9 Evaluation of the methodology on a simulation characterized in Equation 6.4. . . 126 6.10 Convolutional neural network architecture mitigating random delay effect. . . . . 127 6.11 Partial security graph over 100 attacks on the AES_RD dataset. . . . . . . . . . . 128 6.12 Partial security graph over 100 attacks on the ASCAD dataset implementing a random delay effect. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 6.13 Mean rank evolution for generative and discriminative models. . . . . . . . . . . . 131 6.14 Difference between the probabilistic discriminative Pr [Y |T] and the probabilistic generative Pr [T|Y ] approaches given a binary classification problem. . . . . . . . 132 7.1 Transposition between the Pairwise and the Side-Channel paradigms. . . . . . . . 139 7.2 Visualization of the approximation error (Chipwhisperer) . . . . . . . . . . . . . 153 7.3 Evolution of N t rank depending on N p (average over 10 converging models -synchronized datasets) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 7.4 Evolution of N t rank depending on N p (average over 10 converging models -desynchronized datasets) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 8.1 Mutual information ensemble diversity principle considering pairwise components and an ensemble model E = {F 0 , F 1 , F 2 , F 3 , F 4 }. . . . . . . . . . . . . . . . . . . . 168 8.2 t-SNE embeddings. From left to right: Negative Log-Likelihood, Ranking Loss, Ensembling Loss. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 8.3 Diversity versus label accuracy plots for 3 ensemble models trained on Negative Log-Likelihood (NLL), Ranking Loss (RkL) and Ensembling Loss (EL). . . . . . . 174 8.4 κ-statistic. From left to right: Negative Log-Likelihood, Ranking Loss, Ensembling Loss. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175List of Tables3.1 Summary of the most classical side-channel attacks. . . . . . . . . . . . . . . . . . 4.1 Decomposition of the datasets into a training set I p , a validation set I v and an attack set I a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1 Impact of the trace dimension on the conditional variational autoencoder performance (with u = 1, N v = 10, batch-size = 10). . . . . . . . . . . . . . . . . . . . . 5.2 Impact of Boolean masking implementations on the conditional variational autoencoder performance (with batch-size = 64, N v = 10). . . . . . . . . . . . . . . . . . 5.3 Comparison of N t rank value depending on datasets . . . . . . . . . . . . . . . . . . 6.1 Grid search optimization on hyperparameters . . . . . . . . . . . . . . . . . . . . 6.2 Comparison of performance on DPA contest-v4 . . . . . . . . . . . . . . . . . . . 6.3 Comparison of performance on AES_HD . . . . . . . . . . . . . . . . . . . . . . . 6.4 Comparison of performance on ASCAD-v1 with N 0 = 0 . . . . . . . . . . . . . . . 6.5 Comparison of performance on AES_RD . . . . . . . . . . . . . . . . . . . . . . . 6.6 Comparison of performance on ASCAD-v1 with A RD = 50 . . . . . . . . . . . . . 6.7 Comparison of performance on ASCAD-v1 with A RD = 100 . . . . . . . . . . . . . 6.8 Convolutional hyperparameters for each dataset . . . . . . . . . . . . . . . . . . . 7.1 Evolution of N t rank depending on σ (average over 10 converging models) . . . . . 7.2 Evolution of N t rank depending on the number of profiling traces N p (AES_HDaverage over 10 converging models) . . . . . . . . . . . . . . . . . . . . . . . . . . 7.3 Evolution of N t rank depending on the number of profiling traces N p (ASCADaverage over 10 converging models) . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1 Evolution of accuracy depending on σ (30, 000 profiling traces & 3, 000 validation traces) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2 Range of hyperparameters selection . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3 Performance evaluation depending on the diversity's type (Average over 10 physical traces of 1, 088 bits each). Green (resp. Red) cells are considered as practicable (resp. unpracticable) following the SOG-IS recommendations. . . . . . . . . . . . 8.4 Evolution of accuracy depending on σ (20, 000 profiling traces & 2, 000 validation traces) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.5 Performance evolution depending on the diversity applied (Average over 10 physical traces of 256 bits each). Green (resp. Red) cells are considered as practicable (resp. unpracticable) following the SOG-IS recommendations. . . . . . . . . . . . . . . . 8.6 α label for each ensemble method (Average over 10 physical traces of 1, 088 bits each) 8.7 α label for each combination technique (Average over 10 physical traces of 1, 088 bits each) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.8 Performance evolution depending on the committee members (Average over 10 physical traces of 1, 088 bits each) . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1 cVAE-ST vs. Discriminative models from a SCA perspective. . . . . . . . . . . . . xix xx LIST OF TABLES A.1 SNR value for each scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F.1 Architectures and performance related to the networks used for the type I diversity (models trained with the ranking loss) . . . . . . . . . . . . . . . . . . . . . . . . F.2 Architectures and performance related to the networks used for the type I + II diversity (models trained with the ranking loss) . . . . . . . . . . . . . . . . . . . F.3 Range of hyperparameters selection for Bagging models . . . . . . . . . . . . . . . F.4 Range of hyperparameters selection for XGBoost models . . . . . . . . . . . . . .

Contents 1 . 1

 11 The Art of the Secret . . . . . . . . . . . . . . . . . . . . . Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.2.2 A Step Towards the Certification . . . . . . . . . . . . . . . . . 10 1.3 Motivations & Goal of the thesis . . . . . . . . . . . . . . . . . 12 1.4 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Figure 1 . 2 :

 12 Figure 1.2: Structure of AES.

Figure 1 . 3 :

 13 Figure 1.3: Digital signature mechanism.

Figure 1 . 4 :

 14 Figure 1.4: Example of the French Certification Process with Thales considered as the ITSEF.

d

  Figure 1.6: Evolution of the number of DLSCA papers released (April 21 st , 2021). Among the papers we report, only 18% include a GitHub repository.

f

  https://neurips.cc/Conferences/2020/PaperInformation/CodeSubmissionPolicy g https://github.com/paperswithcode/releasing-research-code h To reduce this issue, the Conference on Cryptographic Hardware and Embedded Systems (CHES) (edition 2021) proposes the so-called Artifact Evaluation which supports the open-source and reproducible research within the embedded cryptography's field. Even if this process is currently not taken into account during the submission, this new proposition is a new step towards an open-source research in the sidechannel community.

Figure 2

 2 Figure 2.1: L p -norm visualization for two dimensional vector such that ||x|| p = 1.

Contents 3 . 1

 31 Power Consumption & Data Dependency . . . . . . . . . . . . 3.1.1 CMOS Circuit . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.2 Leakage Model . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 Side-Channel Evaluation . . . . . . . . . . . . . . . . . . . . . . 3.2.1 Measurements . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.2 Leakage Assessment . . . . . . . . . . . . . . . . . . . . . . . . 3.3 Side-Channel Attacks . . . . . . . . . . . . . . . . . . . . . . . . 3.3.1 Optimal Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.2 Simple Side-Channel Analysis . . . . . . . . . . . . . . . . . . . 3.3.3 Differential Side-Channel Analysis . . . . . . . . . . . . . . . . 3.3.4 Performance Metrics . . . . . . . . . . . . . . . . . . . . . . . . 3.4 Side-Channel Countermeasures . . . . . . . . . . . . . . . . . . 3.4.1 Data Randomization . . . . . . . . . . . . . . . . . . . . . . . . 3.4.2 Hiding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5 High-Order Side-Channel Analysis . . . . . . . . . . . . . . . . 3.6 Presentation of the Datasets . . . . . . . . . . . . . . . . . . . . 3.7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 3 .Figure 3 . 2 :

 332 Figure3.2 presents a typical setup used by the Evaluator to assess the robustness of cryptographic modules against side-channel attacks. To perform this evaluation, at least, an oscilloscope, a personal computer (PC), a device under test (i.e. cryptographic module) and one probe capturing the power consumption or the electromagnetic emanations are needed. First, it is assumed that the Evaluator (PC's owner) has a physical access to the cryptographic module. Then, he sends a request to the device under test in order to perform a cryptographic function (e.g. encryption,

  Figure 3.3: A power consumption of an AES-128 encryption.

  Figure 3.4: Leakage assessment of AES-128 encryption function.

DIVIDE

  & CONQUER STRATEGY Definition 3.3.1.1 (Partial Key Recovery). The partial key recovery defines the ability of the Evaluator to recover a sub-part of the secret key k * . Definition 3.3.1.2 (Global Key Recovery). The global key recovery defines the ability of the Evaluator to recover the whole secret key k * .

Figure 3 . 7 :

 37 Figure 3.7: Partial security graph resulting of a CPA which targets one byte of an unprotected AES-128 with known inputs.

  .8.

Figure 3 . 8 :

 38 Figure 3.8: Example of 1 st -order Boolean masking scheme.

( a )

 a Example of a leakage trace from Chip-Whisperer. (b) Signal-to-Noise Ratio.

Figure 3 . 9 :

 39 Figure 3.9: ChipWhisperer dataset.

( a )

 a Example of a leakage trace from DPA contest-v4. (b) Signal-to-Noise Ratio.

Figure 3 .

 3 Figure 3.10: DPA contest-v4 dataset.

( a )

 a Example of a leakage trace from AES_HD. (b) Signal-to-Noise Ratio.

Figure 3 .

 3 Figure 3.11: AES_HD dataset.

( a )

 a Example of a leakage trace from AES_RD. (b) Signal-to-Noise Ratio.

Figure 3 .

 3 Figure 3.12: AES_RD dataset.

( a )

 a Example of a leakage trace from ASCAD-v1. (b) Signal-to-Noise Ratios related to the mask (r3), the masked value (Sbox[X[3] ⊕ k * ] ⊕ r3) and the unmasked value (Sbox[X[3] ⊕ k * ]).

Figure 3 .

 3 Figure 3.13: ASCAD dataset.

( a )

 a Example of a leakage trace from the secure RSA implementation. (b) Signal-to-Noise Ratio.

Figure 3 . 14 :

 314 Figure 3.14: Secure RSA dataset.

n

  https://www.cryptoexperts.com/ (a) Example of a leakage trace from the secure ECC implementation. (b) Signal-to-Noise Ratio.

Figure 3 . 15 :

 315 Figure 3.15: Secure ECC dataset.

Figure 3 . 16 :

 316 Figure 3.16: Scenario of a side-channel analysis.

Contents 4 . 1

 41 What is a Deep Learning Model? . . . . . . . . . . . . . . . . . 54 4.1.1 Principles of Learning Algorithm . . . . . . . . . . . . . . . . . 54 4.1.2 Learning Theory . . . . . . . . . . . . . . . . . . . . . . . . . . 56 4.1.3 Generalization Learning Boundary . . . . . . . . . . . . . . . . 57 4.1.4 Regularization . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 4.2 Model Estimation through Neural Networks . . . . . . . . . . 61 4.2.1 Function Approximation Tools . . . . . . . . . . . . . . . . . . 61 4.2.2 Neural Network Architectures . . . . . . . . . . . . . . . . . . . 63 4.3 A Step Towards the Optimal Parametric Model . . . . . . . . 68 4.3.1 Optimization Problem . . . . . . . . . . . . . . . . . . . . . . . 68 4.3.2 Optimization Challenges . . . . . . . . . . . . . . . . . . . . . . 70 4.4 Application to the Side-Channel Context . . . . . . . . . . . . 73 4.4.1 Objective & Strategy . . . . . . . . . . . . . . . . . . . . . . . . 73 4.4.2 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 4.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

  Definition 4.1.1.2 (Learning algorithm). A learning algorithm aims at selecting the most suitable predictive model F ∈ F for solving a given task. Hence, to select this predictive model, a learning algorithm needs experiences represented by a collection of many leakage traces. Definition 4.1.1.3 (Input). The input of a learning algorithm is defined by a model space F and a collection of data (or examples), denoted as I, from which a learning algorithm learns to complete some class of tasks. Definition 4.1.1.4 (Output). The output of a learning algorithm denotes the element F belonging to some model space F from a set of inputs I, which best solves a given task.

  F aims at predicting a continuous value in Y ⊆ R which characterizes the correlations between labels and D-dimensional inputs. On the other hand, in classification tasks, the learning algorithm is trained to select a model F which assigns a specific class Y ∈ Y to any input leakage trace. This assignment is usually processed by estimating the conditional probability Pr [Y |T] for each class Y ∈ Y such that the prediction Ŷ is considered as the most likely conditional probability (i.e. Ŷ = arg max y∈Y F (T)[y]). Many algorithms have been presented in the literature for resolving classification tasks: naives Bayes [FGG97], k-nearest neighbors [CH67], kernel support vector machines [BGV92, CV95], decision tree classifiers [BFOS84], etc.

  i.d) according to an unknown joint distribution Pr[T, Y ]. Based on a sequence of N p i.i.d pairs (T, Y ), the Evaluator aims at constructing a function F : T → P(Y) which can be used to predict the most likely Y from T. In order to correctly choose F , a criterion has to be set in order to assess the quality of the generated model. Definition 4.1.2.1 (Loss). A loss is a function L : F × Y → R + measuring the degree of disagreement between a selected predictive model F ∈ F, considering T as input, and the expected Y .

Definition 4 .

 4 1.2.2 (True risk). Given a loss L : F × Y → R and a model F : T → P(Y), the true risk R defines the expected loss over the distribution Pr[T, Y ]: R(L, F ) = T ×Y L (F (t) , y) Pr[t, y] dt dy.

Theorem 4.1.3. 1 (

 1 Uniform convergence bound -Finite case).[START_REF] Bousquet | Introduction to Statistical Learning Theory[END_REF] Let F be a finite model space, I p be a labeled training set of size N p i.i.d from an unknown probability distribution Pr[T, Y ] and δ > 0. For any F ∈ F, a generalization bound states that we have:

Figure 4 . 1 :

 41 Figure 4.1: Evolution of the Risk over the Model space complexity.

Figure 4 . 2 :

 42 Figure 4.2: Example of underfitting -overfitting effect on a binary classification task.

Figure 4 . 3 :

 43 Figure 4.3: Geometric interpretation of regularizer using L 1 -norm and L 2 -norm with ||F Θ || p ≤ α constraint which minimizes the empirical risk represented by the solid ellipses.The optimal RERM solution is defined by Θ * but can lead to overfitting issues.

( a )

 a Linear function considering an input, denoted t, a bias, two parameters (θ 0 , θ 1 ) and an output y.(b) XOR function.

Figure 4 . 4 :

 44 Figure 4.4: Graphical representations of diverse functions considering the neural network structure.

  Theorem 4.2.1.1 (Universal Approximation Theorem). [Cyb89, Hor91, Pin99] Let : R → R be any continuous non-polynomial activation function. Let I D be a compact subset R D such that C (I D ) denotes the set of continuous function on I D . Then, given any > 0, there exists N ∈ N,

  (a) Fully-connected neural network structure. (b) Convolutional neural network structure.

Figure 4

 4 Figure 4.5: Graphical representations of diverse architectures classically considered in deep learning-based side-channel attacks.

Figure 4

 4 Figure 4.6: Example of computations performed in a convolutional block.

  Figure 4.6 shows an example of this function applied to a 1-D vector with pooling_window = pooling_stride = 2. Flatten layer. Once the set of n 3 convolutional blocks (i.e. [δ • [ • γ] n2 ] n3 ) has been designed, the flatten layer concatenates each intermediate trace of the final convolutional block in order to reduce the 2-D space, which corresponds to the dimension at the end of the convolutional part, into a 1-D space to fit with the expected dimension of the classification part. Let us denote M the input of the flatten layer such that M ∈ M n,d (R) where n denotes the number of outputs after the last convolutional block and d denotes the output dimension such that:

  retaining the weights induce by the last iteration Θ[l] (n) , or keeping the weight values providing the best performance, i.e. arg min i∈[1,n]

  backpropagation, was introduced by Rumelhart et al. in 1986 [RHW86]. In 1989, Yann LeCun uses backpropagation to train convolutional neural network to recognize handwritten digits [LBD + 89]. The backpropagation is based on the chain rule which is used to compute the derivative of parametric models formed by composing of functions. Definition 4.3.1.1 (Chain rule). [GBC16, Section 6.5.2] Let two vectors a

(a)

  Global minimum (b) Local minimum

Figure 4

 4 Figure 4.7: Evolution of the gradient descent algorithm (red line) on a two-dimensional loss landscape's projection of a parametric model F Θ with Θ = [θ 0 , θ 1 ].

  Side-Channel Context4.4.1 Objective & StrategyAs mentioned at the end of Chapter 3, classical side-channel attacks need multiple steps to retrieve the secret key (i.e. leakage assessment, preprocessing, SSCA/DSCA) that require the expertise of the Evaluator. While the Evaluator spends the majority of his time to preprocess the leakage traces (i.e. synchronization, PoIs' selection, combining the time samples in order to perform a high-order attack), the goal of deep learning-based side-channel analysis is to reduce this phase by generating learning algorithms which automatically find the configuration optimizing the efficiency of side-channel attacks[START_REF] Maghrebi | Breaking cryptographic implementations using deep learning techniques[END_REF][START_REF] Cagli | Convolutional neural networks with data augmentation against jitter-based countermeasures -profiling attacks without pre-processing[END_REF]. While deep learning can be considered to perform non-profiled side-channel attacks[START_REF] Timon | Non-profiled deep learning-based side-channel attacks with sensitivity analysis[END_REF], this manuscript is mainly focused c on the application of deep learning techniques to perform profiled side-channel attacks.

Figure 4

 4 Figure 4.8: Scenario of a deep learning-based side-channel analysis.

Contents 5 . 1

 51 Leakage Trace's Characterization . . . . . . . . . . . . . . . . . 82 5.1.1 Approximation of a pseudo-Boolean function . . . . . . . . . . 82 5.1.2 Approximation of the Leakage Model . . . . . . . . . . . . . . 84 5.1.3 Taxonomy of Generative Models . . . . . . . . . . . . . . . . . 865.2 Conditional VariationalAutoEncoder based on Stochastic Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 5.2.1 Generative Latent Variable Models . . . . . . . . . . . . . . . . 88 5.2.2 Latent Space Estimation and Instances' Generation . . . . . . 90 5.2.3 Learning Similarities . . . . . . . . . . . . . . . . . . . . . . . . 92 5.2.4 Decision Rule & Network Complexity . . . . . . . . . . . . . . 96 5.3 Investigations on the Constructed Generative Model . . . . . 98 5.3.1 Leakage Model Visualization . . . . . . . . . . . . . . . . . . . 98 5.3.2 Multi-Sensitive Variable Attacks . . . . . . . . . . . . . . . . . 100 5.3.3 Curse of Dimensionality . . . . . . . . . . . . . . . . . . . . . . 100 5.3.4 Generalization on Boolean Masking Implementation . . . . . . 102 5.4 Practical Experiments . . . . . . . . . . . . . . . . . . . . . . . 103 5.4.1 A Comparison with Classical Generative Side-Channel Attacks 103 5.4.2 Benefits & Limitations of cVAE-ST . . . . . . . . . . . . . . . . 105 5.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1065.1 Leakage Trace's Characterization5.1.1 Approximation of a pseudo-Boolean functionIntroduced in[START_REF] Schindler | A stochastic model for differential side channel cryptanalysis[END_REF], the stochastic attack is a profiled side-channel attack which takes advantage of the Evaluator's ability to construct a suitable leakage model's estimation. Indeed, as mentioned in Subsection 3.3.3, a profiling attack suggests that the Evaluator has access to an open cryptographic module such that he can estimate the PDFs (Pr[T|Y = y]) y∈Y . Let T = [T[0], T[1], . . . , T[D -1]] be a D-dimensional leakage trace depending on a plaintext X ∈ F n 2 and a secret key k * ∈ F n 2 . Following Equation 3.1, we know that a leakage trace can be decomposed into a deterministic part, defined by a D-dimensional leakage model ψ(Y = f (X, k * )) with f denoting a cryptographic primitive, and a random part Z, characterized by a Gaussian noise N D (0, Σ), that does not depend on X and k * . Hence, in such scenario, the Evaluator approximates the D-dimensional leakage model ψ(Y ) = {ψ 0 (Y ), ψ 1 (Y ), . . . , ψ D-1 (Y )} in order to construct the related PDFs. Theorem 5.1.1.1. [SLP05, Theorem 1] Let k * ∈ F n

  1: Simulation of a linear leakage model ψi,α characterized by Equation 5.2 such that the weighting is similar for all (α j [i]) 0≤j<8 . The red points define the real unknown leakage model ψ i while the blue points denote a sampling coming from the distribution of T[i] for 200 leakage traces.

  degree 2 : quadratic basis + . . . + j1,...,j d j 1 <n,...,j d <n α j1,...,j d [i]

Figure 5 . 2 :

 52 Figure 5.2: Taxonomy of Generative Models.

  [START_REF] Metropolis | The monte carlo method[END_REF]. Hence, for a large number of latent variables {v 0 , . . . , v Nv }, and a label Y , the Evaluator can compute an estimation of Pr [T|Y ]. Indeed, for a given label Y and a latent variable V, we can build a neural network that computes Pr [T|Y, V, Θ]. This model, denoted F (dec) Θ : R D ×F n 2 → R D , is named the decoder. Hence, given a latent variable V ∈ R D and a sensitive variable Y ∈ F n 2 , the decoder generates a new leakage trace T as close as possible to the real observed leakage trace T. However, to perfectly construct a new set of D-dimensional leakage traces from F (dec) Θ , the Evaluator has to estimate the multivariate Gaussian distribution characterizing the latent space V by approximating the following probability distribution Pr [V|T, Y ]. This probability is defined as Pr [V|T, Y ] = Pr[T|V,Y ]•Pr[V] Pr[T|Y ] and it is also intractable due to Equation 5.6. Consequently, a solution is to find a parametric model that approximates the true unknown posterior Pr [V|T, Y ]. In statistics, the variational inference techniques can approximate such complex distributions. Given a leakage trace T ∈ R D and a label Y ∈ F n 2 , a Θ-parametric model can be constructed to estimate the parameters µ V ∈ R D and Σ V ∈ M D ,D (R) of the multivariate Gaussian distribution N D (µ V , Σ V ) such that the KL-divergence between the approximation and the targeted probability distribution Pr [V|T, Y ] is minimized. Such estimation is made by a Θ-parametric model, denoted F (enc) Θ

  R) denotes the set of trainable parameters for a given degree d of Φ (orth.) u

  Figure 5.3: cVAE-ST structure, considering D = D = 2, whereD KL (Pr [V|T, Y, Θ] ||Pr [V]) (resp. E v∼F (enc) Θ -log (Pr [T|Y, v, φ])) denotes the loss introduced in Subsection 5.2.3 namely KL-divergence loss (resp. the reconstruction loss).

  For any choice of encoder F (enc) Θ and trainable parameters Θ, the conditional marginal log likelihood log(Pr [T|Y, φ]) satisfies: log (Pr [T|Y, φ]) = E v∼F (enc) Θ [log (Pr [T, v|Y, φ]) -log (Pr [v|T, Y, Θ])] + D KL (Pr [V|T, Y, Θ] ||Pr [V|T, Y, φ]) . (5.8) Proof. From Equation 5.6 and the work provided by Kingma and Welling [KW19, Section 2.2], we can extend their result to the conditional marginal log likelihood log Pr[T|Y, φ] as follows: log (Pr [T|Y, φ]) = E v∼F (enc) Θ [log (Pr [T|Y, v, φ])]

  parameters µ V,Θ and Σ V,Θ that are needed to compute Pr[V|T, Y, Θ], is able to perfectly predict Pr[V|T, Y, φ] (i.e. D KL (Pr[V|T, Y, Θ]||Pr[V|T, Y, φ]) = 0). In such configuration, the Evaluator exactly captures the random part induced in a leakage trace T. Based on Equation

  from the learned posterior Pr[V|T, Y, Θ] knowing the leakage trace T, the related label Y and the multivariate Gaussian distribution N D (µ V,Θ , Σ V,Θ ), can be seen as encoding T into v, while F (dec) φ

  by the reconstruction loss and seeks to suitably reconstruct T based on a latent representation V and a deterministic part ψφ . KL-divergence loss. However, to reduce the overfitting issue, a regularization term is added (see Subsection 4.1.4). In addition to the optimization of φ, the conditional variational autoencoder concurrently optimizes Θ to minimize the KL-divergence of the approximation Pr [V|T, Y, Θ] from Pr [V]. In addition, the better Pr [V|T, Y, Θ] approximates the true posterior distribution Pr [V|T, Y, φ], in terms of the KL divergence, the smaller the gap between Equation 5.10 and the marginal log-likelihood log(Pr [T|Y, φ]). As remainder, both Pr [V|T, Y, Θ] and Pr [V] are assumed to be Gaussian, specifically, Pr [V|T, Y, Θ] follows N D (µ V,Θ , Σ V,Θ ) and Pr [V] follows N D (0, I D ). The latter distribution is assumed as the leakage traces are standardized, i.e. zero mean and unit variance, and such that no interactions are captured between the time samples. Indeed, as Pr[V] characterizes the random part of T (see Equation 5.7), it has to follow the same distribution as the random part of the real trace T which is N (0, 1) for each non-informative time sample. e To nuance this issue, Bruneau et al. [BGH + 15, Figure 3] illustrate that the information induced by the covariance matrix is mainly brought by its diagonal. f This loss function has already been considered in the side-channel context [Tim19, vdVP19, MWM21].

  .14) where th is the h th generated leakage trace constructed from the decoder Pr[t i |y i , v h , φ]. When the inferred posterior Pr[V|T, Y, Θ] deviates from the true unknown posterior Pr[V|T, Y, φ], the number of samples N v increases in order to obtain an accurate approximation of Pr [T|Y, φ].If the profiling phase has been performed successfully, then t i -imized when k = k * (see Theorem 5.1.1.1). Hence, the most likely candidate is defined through the maximum likelihood rule: [t i |f (x i , k), φ]) .

  Scenario 2 (see Equation 5.16).

Figure 5 . 4 :

 54 Figure 5.4: Weight visualization assessing the suitability of our generative model to retrieve the leakage model.

( a )

 a DPA contest-v4 dataset. (b) AES_HD dataset.

Figure 5 . 6 :

 56 Figure 5.6: Weight visualization of 50 time samples assessing the suitability of our generative model to retrieve the leakage model.

  Definition 6.1.3.1. [Network Confidence] Given a leakage trace T at a time sample i, the Network Confidence defines the capacity of the neural network to retrieve a point of interest at T[i].

Figure 6 . 1 :

 61 Figure 6.1: Methodology for weight visualization ((a) -concatenation of each intermediate trace following their temporal axis ; (b) -computation of Θ[0] to get a temporal correspondence).

Figure 6

 6 Figure 6.3: Convolution operation between a ChipWhisperer leakage trace T and a filter W Θ of size n ((a) -a leakage trace; (b) -zoom on a leakage trace's portion which includes points of interest that are characterized by red crosses; (c) -Heatmap between T and W Θ )

Figure 6 .

 6 Figure 6.3 provides an example of this operation such that four points of interest can be extracted from the leakage trace T (see red crosses in Figure6.3b). In this figure, we show the result of two convolution operations (T W Θ )[i] (see purple cross) and (T W Θ )[i + m] (see green cross) that share the same information related to a point of interest (see Figure3.9b). Consequently, when entanglement occurs the convolved samples share the same relevant information. Therefore, in our example, the PoI is spread over the two convolved samples. By increasing the size n of the filters, we increase the entanglement, consequently, more PoIs are shared between these convolved points. Thus, for a given filter W Θ ∈ R n , the point of interest is spread over 2n convolved samples. If the Evaluator wants to precisely define the temporal space where the points of interest occur, we recommend minimizing the length of the filters in order to reduce the risk of entanglement and ease the training phase.

( a )

 a Filter size = 1. (b) Filter size = 5. (c) Filter size = 11. (d) Filter size = 15.

Figure 6 . 4 :

 64 Figure 6.4: Impact of the filter length on the weights Θ introduced in Equation 6.2.

  interest are shared with AvgP ool(T[l] W[l]

( a )

 a Number of convolutional blocks = 1. (b) Number of convolutional blocks = 2. (c) Number of convolutional blocks = 3. (d) Number of convolutional blocks = 4.

Figure 6 . 5 :

 65 Figure 6.5: Impact of the number of convolutional blocks on the weights Θ introduced in Equation 6.2.

( a )

 a Partial security graph over 100 attacks. (b) Weight visualization.Gradient value (c) Gradient visualization.

Figure 6 . 6 :

 66 Figure 6.6: Evaluation of the DPA contest-v4 dataset.

( a )

 a Partial security graph over 100 attacks. (b) Weight visualization.

Figure 6 . 7 :

 67 Figure 6.7: Evaluation of the AES_HD dataset.

  initialize the number of filters to 4 with a length of 1. Then, two dense layers composed of 10 neurons complete the neural network. Thanks to the one cycle policy, we are able to configure our learning rate in the range [5 × 10 -4 ; 5 × 10 -3 ]. The network is trained for 50 epochs with a batch size of 50. Next, we compare our result with the original paper [BPS+ 20]. Surprisingly, we can notice that the network detects more points of interest than the mask and the masked value. By visualizing the weights, we can evaluate that the neural network recognizes relevant information related to the mask and the masked values, although a sensitive area (between time samples 380 and 450, see Figure6.8c) is detected by the neural network whereas nothing appears on the SNR (see Figure3.13b). Like the DPA contest-v4 experiment, the weight visualization and the gradient visualization are similar. The classification part appears to be optimized because no information is lost between the end of the feature selection part and the output of the neural network.

( a )

 a Partial security graph over 100 attacks. (b) Weight visualization.

Figure 6 . 8 :

 68 Figure 6.8: Evaluation of the ASCAD dataset with no desynchronization.

( a )

 a Heatmap of the first convolutional block. (b) Heatmap of the second convolutional block. (c) Heatmap of the third convolutional block.(d) Signal-to-noise ratio.

Figure 6

 6 Figure 6.10: Convolutional neural network architecture mitigating random delay effect.

Figure 6 .

 6 Figure 6.11: Partial security graph over 100 attacks on the AES_RD dataset.

(

  a) A RD = 50. (b) A RD = 100.

Figure 6 .

 6 Figure 6.12: Partial security graph over 100 attacks on the ASCAD dataset implementing a random delay effect.

:Figure 6

 6 Figure 6.13: Mean rank evolution for generative and discriminative models.

Figure 6 . 14 :

 614 Figure 6.14: Difference between the probabilistic discriminative Pr [Y |T] and the probabilistic generative Pr [T|Y ] approaches given a binary classification problem.

Figure 7 . 1 :

 71 Figure 7.1: Transposition between the Pairwise and the Side-Channel paradigms.

  Consequently, P I Y ; T; Θ -M I Y ; T; Θ = P I Y ; T; Θ -P I (Y ; T; Θ * ) -M I Y ; T; Θ -M I (Y ; T; Θ * ) + P I (Y ; T; Θ * ) -M I (Y ; T; Θ * ) = P I (Y ; T; Θ * ) -M I (Y ; T; Θ * ) . (7.21) Equation 7.21 defines that the difference of the models lies in the approximation error generated between P I (Y ; T; Θ * ) and M I (Y ; T; Θ *

  SNR of the Chipwhisperer dataset

Figure 7 . 2 :

 72 Figure 7.2: Visualization of the approximation error (Chipwhisperer)

Figure 7 . 3 :

 73 Figure 7.3: Evolution of N t rank depending on N p (average over 10 converging modelssynchronized datasets)

Figure 7 . 4 :

 74 Figure 7.4: Evolution of N t rank depending on N p (average over 10 converging modelsdesynchronized datasets)

( a )

 a Interactions induced by the parametric model F 1 with each other. (b) Interactions induced by the parametric models included in E.

Figure 8 . 1 :

 81 Figure 8.1: Mutual information ensemble diversity principle considering pairwise components and an ensemble model E = {F 0 , F 1 , F 2 , F 3 , F 4 }.

Figure 8

 8 Figure 8.2: t-SNE embeddings. From left to right: Negative Log-Likelihood, Ranking Loss, Ensembling Loss.

Figure 8 .

 8 Figure8.2 illustrates the t-SNE visualizations depending on the loss used during the training process. When the negative log-likelihood is considered, we observe that the ensemble model is not trained enough to efficiently discriminate each class. Indeed, there are many connections between each class leading to a loss of the global performance. Hence, many FP and FN can badly influence the global performance of the model. Through this visualization, we can question the relevance of the negative log-likelihood as the best solution in our context when low complexity models are considered. This observation is in accordance with the demonstration provided in Subsection 7.2.2. On the other hand, the ranking loss generates three separate clusters. As mentioned in Subsection 8.3.1, the ranking loss can be formulated as the relevance loss (see Equation8.4). Through the minimization of this function, we aim at approximating the mutual information between a leakage trace T and a targeted label Y (see Subsection 7.2.1). In other words, we minimize the conditional entropy e H(Y |T ) which promotes the generation of three compact clusters. Figure8.2 confirms this result as the ensemble model is overconfident in the features captured during the learning process. Consequently, it makes discriminative decisions to avoid connections between each cluster. However, following the t-SNE illustration, the FP and FN induced by the ranking loss are persistent and seem difficult to detect. Indeed, these errors are fully included in a wrong cluster. This result suggests that the ensemble model considering the ranking loss assigns a similar confidence to correct and wrong predictions. This phenomenon can be explained by the overfitting effect. Using more training examples could be useful to reduce this impact and reduce the error rate. However, when the number of profiling traces is limited (as often in practice), a solution has to be found to improve the ensemble model performance. The best solution should create three separate clusters when the ensemble model is confident in its prediction while, the errors or the uncertain predictions should converge towards the equidistant point of the centroid of the clusters. These examples are called data uncertainty. Introduced in[START_REF] Malinin | Ensemble distribution distillation[END_REF], data uncertainty is the irreducible uncertainty in predictions which arises due to the complexity or noise in the data. In Figure8.2, we can observe that the ensembling loss converges towards this best solution. Indeed, the combination of the relevance loss, the conditional redundancy loss and the redundancy loss creates three separate clusters (see Appendix E for deeper details). When the ensemble model is confident in its predictions, it will assign the related examples to the correct class. However, the ensembling loss creates some connections between the clusters which seem defined by the data uncertainty. This result tends to reduce the number of consistent FP and FN such that few errors can be detected on each cluster in contrast with the negative log-likelihood or the ranking loss. While the Evaluator's goal is to enhance the ensemble diversity, the t-SNE tool does not provide information related to this requirement. To validate the

  an ensemble model E (Disagreement measure [Ska96, KH98], Q-statistic [UY00], Correlation coefficient [SS73], κ-statistic [Coh60], Double-Fault measure [GR01], ...); • Non-Pairwise measures that assess the ensemble diversity directly rather than by averaging pairwise measurements (Kohavi-Wolpert Variance [KW96], Interrater agreement [Die00b, FLP03], Entropy [CC00], ...).

Figure 8 . 3 :

 83 Figure 8.3: Diversity versus label accuracy plots for 3 ensemble models trained on Negative Log-Likelihood (NLL), Ranking Loss (RkL) and Ensembling Loss (EL).

Figure 8

 8 Figure 8.4: κ-statistic. From left to right: Negative Log-Likelihood, Ranking Loss, Ensembling Loss.

Figure 8

 8 Figure 8.5: κ-statistic. From left to right: Ensembling Loss, Ensembling Loss + Type I diversity, Ensembling Loss + Type I + II diversity.

Figure 8 . 6 :

 86 Figure 8.6: Diversity versus label accuracy plots for ensemble models trained on Ensembling Loss (EL), Ensembling Loss (EL) + Type I diversity and Ensembling Loss + Type I + II diversities.

Figure 8 . 8 :

 88 Figure 8.8: Diversity versus label accuracy plots for 3 ensemble models trained on Negative Log-Likelihood (NLL), Ranking Loss (RkL) and Ensembling Loss (EL) for the binary classification.

Figure 8

 8 Figure 8.7: t-SNE embeddings. From left to right: Negative Log-Likelihood, Ranking Loss, Ensembling Loss.

(

  a) N c = 3. (b) N c = 5. (c) N c = 10. (d) N c = 16.

Figure 8 . 9 :

 89 Figure 8.9: Mutual information ensemble diversity principle considering pairwise components with ensemble model E with different size N c .

  Modeling side-channel attacks boils down to be able to model the relationship between a leakage trace T and a targeted sensible variable Y which can be addressed by modeling the true unknown condition distribution Pr[T|Y ]. The first part of this manuscript differentiates two traditional approaches to approximate this distribution. While a classical deep learning approach consists in considering discriminative models in order to directly estimate Pr[T|Y ], alternative solutions, known as generative models, approximate Pr[Y |T] which can be simplified as Pr[T|Y ] up to an additive constant if the logarithm representation is considered (see Subsection 3.3.3). This thesis illustrates the benefits and the limitations of both solutions from an Evaluator point of view. While the Deep Learning field is useful to mitigate the inconsistent choices made by the Evaluator during the preprocessing phase and to provide a clear gain in attack efficiency, its lack of explainability in the side-channel context remains a tremendous issue.

  b] = Sbox[X ⊕ k * ][b]denotes the b th bit of the output of the Sbox and Z[i] is a Gaussian noise following N (0, σ 2 ) such that σ 2 ∈ {0.1, 1, 10}.

  Figure A.2, Figure A.3, Figure A.4 and Figure A.5).

Figure A. 2 :

 2 Figure A.2: Weight visualization for Scenario 1 (Legend: see Figure A.1)

R-

  (L CRL , F n , F m ) = log 2 e -β|s Na,i (Fn,k * )-s Na,i (Fm,k * )| , where β is one hyperparameter that characterizes the impact of the distance on the penalization term and s Na,i (F n , k * ) defines the score related to the class k * given a set of N a traces and a parametric model F n .Remark D.1. Furthermore, through the maximization of the probability of observing F n and F m knowing the sensitive variable Y , we force the ensemble model to assign similar score to the class related to Y such that, the probability of observing F n knowing Y is similar to the probability of observing F m knowing Y . Thus, we encourage each term of the denominator of Equation D.3 to converge towards the same solution.

R

  (L RedL , F n , F m ) =

  The first profiled side-channel attack, namely template attack (TA), was introduced by Chari et al. in 2002[START_REF] Chari | Template attacks[END_REF]. In the original paper, it is assumed that the PDFs (Pr [T = t|Y = y]) y∈Y are the density of a (multivariate) Gaussian distributionN D (µ Y , Σ Y ) such that the pair (µ Y , Σ Y )is dependent on the targeted sensitive variable Y . During the profiling phase, the Evaluator estimates the empirical mean and the empirical covariance matrix for each y ∈ Y. For a set of D-dimensional leakage traces T , the estimation of the D × D covariance matrix Σ y for each y ∈ Y can be impracticable. More precisely, if N leakage traces are needed to adequatly approximate Σ y for each y ∈ Y, the total amount of physical measurements that is required to compute all covariance matrices is N • |Y|. Thus, the Evaluator has to find the best trade-off between the number of acquired leakage traces, his storage capacity and the optimal estimation of (Σ y ) y∈Y .

	To
	circumvent it, Choundary and Kuhn propose to pool the covariance matrix into a single solution
	in order to ease its estimation [CK14]. The pooling consists in considering a unique covariance
	matrix, denoted Σ for all y ∈ Y. Consequently, whatever the manipulated sensitive variable, the
	related multivariate Gaussian distribution can be reduced to N D (µ Y , Σ) for each y ∈ Y. Once
	the profiling phase is performed, the Evaluator can apply the log-likelihood distinguisher on the
	PDFs' estimation in order to guess the secret key manipulated by the cryptographic module.
	If the estimation of the PDFs are equal to the true unknown PDFs (i.e. Pr [T|Y ] = Pr [T|Y ]),
	then, the template attacks maximize the probability of attack success. From a side-channel
	perspective, the template attacks are known as the most powerful solution. An alternative to the
	template attacks have been introduced in 2005 by Schindler et al. [SLP05]. This proposition,
	called stochastic attacks (SA), will be addressed in Section 5.1. All the attacks introduced are
	summarized in Table 3.1 and linked with their related configurations.

Table 3 .

 3 1: Summary of the most classical side-channel attacks.

		Side-Channel Attacks
	Simple Power Analysis [Koc96]	Differential Power Analysis [KJJ99]	Correlation Power Analysis [BCO04]	Mutual Information Analysis [GBTP08]	Template Attacks [CRR03]	Stochastic Attacks [SLP05]
	Operation Flow
	Processed Data
	Horizontal *
	Vertical
	Profiled
	Non-

profiled Symmetric cryptographic implementations. For

  symmetric cryptographic implementations, we define a key recovery attack using a distinguisher D as successful if, for a given set of N a attack traces, the Evaluator retrieves the entire value of the secret key k * ∈ F n 2 . From a distinguisher, the Evaluator predicts the sensitive variables manipulated by the cryptographic module. Knowing the inputs used during the cryptographic process (e.g. encryption), he can use a set of N a attack traces and compute a score vector, based on D (e.g. difference of means, Na (D LL , k).). Given a set T of N a attack leakage traces, a set of plaintext X and the Log-Likelihood distinguisher D LL , the score s Na (D LL , k) related to a key hypothesis k ∈ K can be computed as follows:

	Pearson's correlation, mutual information, log-likelihood).
	Given the score associated with each key hypothesis k ∈ K, the Evaluator can classify all the key
	candidates into a vector of size |K|, denoted g Na = g 1 Na , g 2 Na , . . . , g	|K| Na , such that:
	g Na (D, k ) =	1 s Na (D,k)≥s Na (D,k ) ,
	k∈K
	where s Na (D, k) denotes the score related to key candidate k ∈ K for a given number N a of attack
	leakage traces and a given distinguisher D.
	Example 3.3.4.1 (Computation of s

Definition 3.3.4.4 (Ranking Entropy

  To fix this issue,Standaert et al. propose two new metrics[START_REF] Standaert | A unified framework for the analysis of side-channel key recovery attacks[END_REF]: the Success Rate and the Guessing Entropy.In other words, the o th order success rate is defined as the probability that the targeted secret k * is ranked amongst the o first key guesses in the score vector g Na . From an exhaustive search perspective, the o th order success means that the attacker has, at most, o key candidates to test after the attack in order to recover the secret key k * . In side-channel attacks, the Evaluator wants to find a distinguisher D such that the condition SR o (N a ) > β is verified with the minimum number N a of attack traces (see Objective 3.3.1.1). ). The ranking entropy is defined as the expected logarithm of the rank of the secret key k * such as:

	More precisely, the success rate is a probability measure quantifying the number of attack traces
	that are needed for retrieving the secret key stored into a cryptographic module.
	Definition 3.3.4.2 (Success Rate). Given a number of traces N a , the Success Rate (SR) is a
	metric that defines the probability that an attack succeeds in recovering the secret key k * amongst
	all hypotheses.
	A success rate of β means that β attacks succeed in retrieving k * over 100 realizations. In [SMY09],
	Standaert et al. propose to extend the notion of success rate to an arbitrary order o such that:
	SR o (D, N a ) = Pr [g Na (D, k * ) ≤ o] .	(3.6)
	Definition 3.3.4.3 (Guessing Entropy). The guessing entropy is defined as the expected rank of
	the secret key k * such as:
	GE(D, N a ) = E [g Na (D, k * )] .
	In other words, the guessing entropy measures the average number of key guesses that have
	to be tested before finding the secret key. In [MMOS16], Martin et al. propose to take into
	account the orders of magnitude of the rank in order to quantify the remaining brute-force budget.
	This solution can be employed when the Evaluator has to deal with key enumeration algorithms
	[VCGRS13, VCGS13, PSG16].

  .6 gives an example

			-10		-1.76	9.46		1.05
					9.46	9.46	11.56
	-4	Convolution Size of kernels = 3 Number of kernels = 3 Stride = 1 Padding = Same	-25 -24 4 -16	SeLU = 1.0507 = 1.6732	-1.76 -1.76 -1.76 9.46	27.32 29.42 8.41 12.61	5.25 8.41 8.41 0	Average Pooling Pooling stride = 2 Pooling window = 2	3.85 9.46 6.28 6.83 -1.7628.37 3.85 4.21 10.51

  ( sof tmax • λ |Y| ). Finally, a convolutional neural network is concluded by a predicting layer which is a fully-connected layer composed by |Y| neurons such that a softmax activation function sof tmax is computed in order to turn a vector of |Y| real values into a vector of |Y| real values that sum to 1. Hence, the softmax activation function is useful to convert the output of λ |Y| , namely scores, to a normalized probability distribution, which can then be considered to compute the log-likelihood distinguisher (see Definition 3.3.3.4). To construct an effective convolutional neural network, the Evaluator has to deal with a plethora of parametric variables that he has to configure. While these convolutional neural networks were specifically designed to fit with the image classification problem, the side-channel community started to investigate their suitability in deep learning-based side-channel attacks [CDP17a, PSK + 18, KPH + 19, ZS19, BPS + 20, JZHY20, GJS20, MS21]. In Chapter 6, we propose to investigate the impact of multiple hyperparameters (i.e. length of filters, number of convolutional blocks, pooling layers) in order to design a convolutional neural network specific to the side-channel context such that the convolutional part focuses its interest only on the PoIs.

	Designing Issue.

Definition 4.2.2.4 (Model hyperparameters). The model hyperparameters refer to parametric variables whose values are defined by the Evaluator in order to design the neural network architecture.

Depending on the choice of the model hyperparameters (e.g. number of layers, number of neurons per layer, length of filters, number of convolutional blocks), the performance of the neural network varies considerably. In convolutional neural networks, these hyperparameters are defined by number of convolutional layers, number of convolutional blocks, number of filters per convolutional layer, length of filters per convolutional layer, number of fully-connected layers, number of neurons per fully-connected layer, etc.

For a neural network, a basic question is how to trade off between its width and depth: Should the Evaluator uses convolutional neural networks that are narrow and deep (many layers, with a small number of neurons per layer), or shallow and wide? Hence, choosing correct model hyperparameters is the first step towards obtaining an optimal neural network.

OPEN QUESTION

One classical solution is to consider the convolutional neural networks already proposed by the deep learning community: LeNet [LBD + 89], AlexNet

[START_REF] Krizhevsky | Imagenet classification with deep convolutional neural networks[END_REF]

, VGGNet

[START_REF] Simonyan | Very deep convolutional networks for large-scale image recognition[END_REF]

, InceptionNet [SVI + 16], ResNet

[START_REF] He | Deep residual learning for image recognition[END_REF]

etc.

  Notably, this leads the side channel community to investigate it as the classical loss function to consider when deep learning-based side-channel attacks are performed [MPP16, CDP17a, PHJ + 18, CCC + 19, MDP19b, BPS+ 20]. In[START_REF] Masure | A comprehensive study of deep learning for side-channel analysis[END_REF], Masure et al. deeply investigate the benefits of the negative log likelihood to train a specific parametric model for side-channel attacks. However, one limitation of this loss is the lake of concordance with the performance metric that has to be optimized in classical side-channel attacks, i.e. success rate (see Definition 3.3.4.2).

In Chapter 7, we reduce this issue by defining a new loss function which derives from the success rate and extends the work provided by Masure et al..

However, optimizing a non-convex empirical risk raises questions about the ability of the gradient descent algorithm to converge towards the optimal solution.

  While the goal of the deep learning-based side-channel analysis is to reduce the preprocessing phase, several techniques remain beneficial to reduce some risks as the class imbalance issue. This phenomenon arises when the classes, defined by Y, are not equally represented e . It induces a non-negligible bias such that the trained parametric model emphasizes the majority class. To circumvent this issue, the side-channel community adopts diverse techniques as SMOTE [PHJ + 18, WJB20], desynchronization[START_REF] Cagli | Convolutional neural networks with data augmentation against jitter-based countermeasures -profiling attacks without pre-processing[END_REF], noise addition [KPH + 19], Mixup [LZW+ 21, Abd21]. Other preprocessing approaches like de-noising[START_REF] Wu | Remove some noise: On pre-processing of sidechannel measurements with autoencoders[END_REF][START_REF] Kwon | Non-profiled deep learningbased side-channel preprocessing with autoencoders[END_REF] or leakage trace embedding[START_REF] Wu | The best of two worlds: Deep learning-assisted template attack[END_REF] have been proposed to enhance the resulted side-channel attacks. Finally, while the main deep learning-based side-channel attacks are performed in time domain,

the community starts to investigate the benefits of other representations (time-frequency domain

[START_REF] Yang | Convolutional neural network based side-channel attacks in time-frequency representations[END_REF]

, image representation [WHJ + 21a, HHGG20]).

e A classical example considers the Hamming Weight as leakage model ψ. For example, if Y ∈ F 8 2 , the probability of observing HW (4) equals approximately 0.273 which is more than 2 times higher than uniform probability.

Table 4 .

 4 1: Decomposition of the datasets into a training set I p , a validation set I v and an attack set I a .

		ChipWhisperer DPA contest-v4 AES_HD AES_RD ASCAD-v1 Secure RSA Secure ECC
	I p	45, 000	4, 000	45, 000	20, 000	45, 000	30, 000	20, 000
	I v	5, 000	500	5, 000	5, 000	5, 000	3, 000	2, 000
	I a	50, 000	500	25, 000	25, 000	10, 000	10, 880	2, 560

  Θ from neural network structures (e.g. multi-layer perceptron, fully-connected neural network, convolutional neural network, residual neural networks). The choice made in this manuscript is to only consider the convolutional neural networks because the literature [CDP17a, Mag19a, MBC+ 20] demonstrates its robustness against hiding countermeasures. Once the parametric function is characterized, the Evaluator updates the trainable parameters induced in F Θ in order to optimize the ERM. Even if the deep learning paradigm is highly beneficial to reduce the limitations of classical side-channel attacks, it is unclear how both fields can be connected.As breafly defined in Subsection 4.1.1, classical side-channel attacks retrieve the secret key by approximating the following conditional probability distribution Pr [T|Y ]. This approach, known as generative, can be opposed to the traditional deep learning neural network which estimates the following conditional probability distribution Pr [Y |T], known as discriminative. While both approaches can be considered as supervised learning, some differentiations can be highlighted. The next part opposes both approaches. While Chapter 5 proposes the first generative model in order to perform deep learning-based side-channel attacks, Chapter 6 introduces a new design to construct discriminative models. Those propositions aim at bridging deep learning and classical profiled side-channel attacks.To bridge deep learning and classical profiled side-channel attacks, this chapter firstly describes one of the most generic profiled attacks, namely the stochastic attack[START_REF] Schindler | A stochastic model for differential side channel cryptanalysis[END_REF], that approximates the targeted leakage model ψ as a pseudo-Boolean function. After a generic discussion about the generative models, we reduce the gap between the deep learning and the side-channel context by introducing a new neural network architecture, namely conditional variational autoencoder, that is based on the stochastic attack. Then, this new approach is faced with typical side-channel issues namely, interpretability, curse of dimensionality, and protection with Boolean masking scheme.

	Chapter 5
	Learning Generative Models from
	Side-Channel Attacks' Foundation
	Part II
	WHAT'S NEXT?
	Generative vs. Discriminative
	Models in Deep Learning
	Side-Channel Attacks

Finally, a comparative investigation is proposed with profiled side-channel attacks and some limitations regarding the application of generative models in side-channel analysis are highlighted.

  has been originally introduced as an unsupervised generative approach which explicitly approximates the density Pr [T]. To extend this neural network to supervised learning, Sohn et al. proposed the conditional variational autoencoder[START_REF] Sohn | Learning structured output representation using deep conditional generative models[END_REF] to approximate the true unknown conditional probability distribution Pr [T]. (Latent Space). Given a set of leakage traces T ∈ R D , a latent space V of dimension D (s.t. D ≤ D) is a vector space spanned by the latent variables in which similar leakage traces are closer together in the related D -dimensional space. (Latent Variable). A latent variable v ∈ R D is a non-observable variable that is sufficient to describe a leakage trace.

	Definition 5.2.1.2
	Ever since the seminal works have been widely applied in various fields (e.g. face generation
	[KW14, KWKT15], handwritten digits [KW14], objects [KWKT15]), we propose to contextualize
	conditional variational autoencoder into side-channel analysis in order to give a new perspective
	for generative models.

Starting from the definition of explicit density estimation approach defined in Subsection 5.1.3, conditional variational autoencoder aims at modeling the Θ-parametric conditional distribution Pr [T|Y, Θ] from two random variables T ∈ R D and Y ∈ F n 2 .

Definition 5.2.1.1

Table 5 .

 5 1: Impact of the trace dimension on the conditional variational autoencoder performance (with u = 1, N v = 10, batch-size = 10).

	P RI %	D	Learning rate N t rank Network complexity Training time (seconds)
	33%	3	10 -2	47	1, 566	7s
	10%	10	10 -2	51	5, 360	8s
	2%	50	10 -2	49	30, 800	35s
	1%	100	10 -2	46	71, 600	47s
	0.2%	500	10 -3	52	758, 000	401s
	0.1%	1000	10 -3	65	2, 516, 000	933s

Table 5 .

 5 2: Impact of Boolean masking implementations on the conditional variational autoencoder performance (with batch-size = 64, N v = 10).

	Order

Learning rate N t rank Combining function Network complexity

	0	10 -2	9	Optimal product	2, 630
	1	10 -2	32	Optimal product	14, 150
	2	10 -3	100	Optimal product	95, 750
	3	10 -3	247	Absolute difference	1, 103, 750

Table 5 .

 5

3: Comparison of N t rank value depending on datasets

Pooled Stochastic Attacks Pooled Template Attacks cVAE-ST DPA-contest v4

		4	4 [KPH + 19]	4
	AES_HD	4, 500	25, 000 [KPH + 19]	250
	ASCAD-v1	290	351	190

  -While the goal of a side-channel attack is to optimize a learning algorithm which approximates Pr[Y |T] in order to discriminate a sensitive variable Y from a set Y, the application of generative models can be considered as suboptimal[START_REF] Ng | On discriminative vs. generative classifiers: A comparison of logistic regression and naive bayes[END_REF]. However, as computing Pr[T|Y ] is approximately similar to Pr[Y |T] up to a constant independent of the secret key (see Equation 3.4), the Evaluator expects to obtain similar result regardless the estimated conditional probability. This verification is performed in Chapter 6.One solution to solve the latter issues is to substitute the generative approach by the discriminative approach. Probabilistic discriminative approach captures the decision boundaries between the classes in Y such that no particular modeling of the leakage trace distribution is performed.

It models the conditional posterior probabilities Pr [Y |T] directly in order to discriminate and pick the most likely hypothetical candidate (i.e. sensitive information) given a leakage trace. A discriminative model estimates a Θ-parametric probability conditional distribution Pr [Y |T, Θ] that is as similar as possible to the true unknown conditional probability distribution Pr [Y |T].

In Subsection 4.2.2, this model is characterized by F Θ such that the last layer of the neural network is defined by a softmax (resp. sigmoid) activation function if a multiclass (resp. binary) classification problem has to be solved. In deep learning-based side-channel attacks, this approach is beneficial for directly retrieving the secret key manipulated by the cryptographic module without modeling unnecessary information or performing preprocessing phase [MPP16, CDP17a, PHJ + 18, CCC

+ 19]

  , if the weight related to i is low, i.e. similar to the weight related to uninformative time samples, the neural network will be distrustful on the leakage detection. Hence, the resulted exploitation will be harder or inexistent and the training time could increase. If necessary, this visualization can be performed during the training process in order to evaluate the suitability of the selected model F Θ . However, even if the weight visualization is a useful tool to get a global overview of the feature selection part, the Evaluator still cannot investigate the sample extracted by each filter. One solution is to analyze the activation generated by the convolution operation between an input layer and each filter.

		1
	1	Convolutional Block
	Convolutional Layer	Pooling Layer
		Figure 6.2: Heatmap

hand

  To train the learning algorithm, we use the negative log-likelihood as loss function (see Definition 4.3.2.2) as it is generally considered in deep learning based side-channel analysis [MPP16, CDP17a, PHJ + 18, CCC + 19, MDP19b, BPS+ 20]. Further discussion on this loss function will be provided in Chapter 7. As mentioned in Subsection 4.3.2, the optimizing algorithm used in this manuscript is the Adam optimizer[START_REF] Goodfellow | Deep Learning. Adaptive computation and machine learning[END_REF]. A batch-size of 50 is configured. As explained in Subsection 4.2.1, we use the SELU activation function to mitigate the vanishing and exploding gradient issues. The loss function, the optimizer and the activation function have been selected following a grid search optimization

Table 6

 6

	.1: Grid search optimization on hyperparameters
		Values
	Optimizer	{SGD, RMSprop, Adam}
	Activation function {tanh, ReLU, ELU [CUH16], SELU}
	Learning Rate	One-Cycle policy (see Section 6.3)
	Batch size	{50, 64, 128, 256}
	Epochs	{10, 20, 25, 50, 75, 100, 125, 150}
	N FC layers	{2, 5, 10, 15, 20, 25, 100}
	N nodes per FC layers	{1, 2, 3, 4, 5}

Table 6 .

 6 2: Comparison of performance on DPA contest-v4

		State-of-the-art	Our
		([PHJ + 18])	methodology
	Complexity (trainable parameters)	52, 112	8, 782
	N t rank	4	3
	Training time (seconds)	1, 000	23

Table 6 .

 6 3: Comparison of performance on AES_HD

		State-of-the-art	Our
		([KPH + 19])	methodology
	Complexity (trainable parameters)	104, 401, 280	3, 282
	N t rank	25, 000	1, 050
	Training time (seconds)	6, 075	31

Table 6 .

 6 4: Comparison of performance on ASCAD-v1 with N 0 = 0

		State-of-the-art	Our
		([BPS + 20])	methodology
	Complexity (trainable parameters)	66, 652, 444	16, 960
	N t rank	1, 146	191
	Training time (seconds)	5, 475	253

Table 6 .

 6 5: Comparison of performance on AES_RD

		State-of-the-art	Our
		([KPH + 19])	methodology
	Complexity (trainable parameters)	512, 711	69, 080
	N t rank	10	5
	Training time (seconds)	4, 500	1, 965

Table 6 .

 6 6: Comparison of performance on ASCAD-v1 with A RD = 50

		State-of-the-art	Our
		([BPS + 20])	methodology
	Complexity (trainable parameters)	66, 652, 444	87, 279
	N t rank	> 5, 000	244
	Training time (seconds)	5, 475	380

Table 6 .

 6

		State-of-the-art	Our
		([BPS + 20])	methodology
	Complexity (trainable parameters)	66, 652, 444	142, 044
	N t rank	> 5, 000	270
	Training time (seconds)	5, 475	512

7: Comparison of performance on ASCAD-v1 with A RD = 100

Table 6 .

 6 8: Convolutional hyperparameters for each dataset

		Layer	Length of the filters Pooling stride Number of filters
		1 st convolutional block	1	2	8
	AES_RD	2 nd convolutional block	500	500	16
		3 rd convolutional block	3

Table 7 .

 7 1: Evolution of N t rank depending on σ (average over 10 converging models)

	N t rank	σ	0 10 -6 10 -5 10 -4 10 -3 10 -2 10 -1	Training time (seconds)
	Negative Log-Likelihood 4	4	6	6	7	21	3,958	81 s
	Cross-Entropy Ratio		4	5	6	8	17	20	3,812	143 s
	Ranking Loss		3	3	3	3	3	13 2,927	294 s

Table 7 .

 7 2: Evolution of N t rank depending on the number of profiling traces N p (AES_HD -average over 10 converging models)

	N t rank	N p	10, 000	15, 000 20, 000 25, 000 30, 000 35, 000 40, 000 45, 000
	Negative Log-Likelihood >25,000	13,855	5,685	2,220	1,725	1,385	1,235	1,165
	Cross-Entropy Ratio		>25,000	19,591	5,158	2,390	2,115	1,397	1,259	1,206
	Ranking Loss		>25,000 11,298 2,443 1,805 1,370 1,280 1,210 1,115

Table 7 .

 7 3: Evolution of N t rank depending on the number of profiling traces N p (ASCAD -average over 10 converging models)

	N t rank	N p	10, 000 15, 000 20, 000 25, 000 30, 000 35, 000 40, 000 45, 000
	Desync 0	Negative Log-Likelihood >8,000 Cross-Entropy Ratio >8,000 Ranking Loss >8,000 1,740 2,135 3,015	1,054 1,771 709	705 1,220 481	471 950 334	435 437 272	318 313 258	270 295 244
	Desync 50	Negative Log-Likelihood >8,000 Cross-Entropy Ratio >8,000 Ranking Loss >8,000 3,475 1,792 4,172 2,342 6,640 3,042	1,041 1,473 765	792 1,028 641	656 742 558	577 567 449	337 403 345
	Desync 100	Negative Log-Likelihood >8,000 Cross-Entropy Ratio >8,000 >8,000 >8,000 >8,000 >8,000 >8,000 >8,000 >8,000 7,593 3,343 1,175 756 570 473 371 Ranking Loss >8,000 4,883 2,216 696 584 496 390 325

8.1 Evaluation of Public-Key Cryptographic Implementations . . 160

  Application on 1 Trace Exploitation . . . . . . . . . . . . . . . 180 8.4.3 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182

	8.1.1 Evaluator's Restrictions . . . . . . . . . . . . . . . . . . . . . . 160
	8.1.2 Complexity Measures . . . . . . . . . . . . . . . . . . . . . . . 161
	8.2 The Principle of Ensembling . . . . . . . . . . . . . . . . . . . . 163
	8.2.1 A Source of Diversity . . . . . . . . . . . . . . . . . . . . . . . 164
	8.2.2 Mutual Information Ensemble Diversity . . . . . . . . . . . . . 166
	8.3 Ensembling Loss: A Pairwise Ensemble Diversity Metric . . 167
	8.3.1 Mutual Information Ensemble Diversity Estimation . . . . . . 168
	8.3.2 Enhancing the Features' Diversity . . . . . . . . . . . . . . . . 171
	8.4 A Case Study on Asymmetric Implementations . . . . . . . . 175
	8.4.1 Application on N Traces Exploitation . . . . . . . . . . . . . . 176
	8.4.2

8.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. 184 8.1 Evaluation of Public-Key Cryptographic Imple- mentations 8.1.1 Evaluator's Restrictions

  Introduced in[START_REF] Schindler | Power attacks in the presence of exponent blinding[END_REF], the Alternate Attack targets RSA modular exponentiation protected with exponent blinding. Based on the Basic Attack and the Enhanced Attack[START_REF] Schindler | Exponent blinding does not always lift (partial) spa resistance to higher-level security[END_REF], the alternate attack retrieves the secret exponent bits from multiple traces. This attack can be extended to Elliptic Curves[START_REF] Schindler | Power attacks in the presence of exponent blinding[END_REF] and RSA with CRT c [SW17]. However, some tricks are specific to each case study. In this manuscript, we only focus on the application of the alternate attack on RSA without CRT. In particular, we formulate a complexity equation for this alternate attack that is missing from the original paper. In[START_REF] Schindler | Power attacks in the presence of exponent blinding[END_REF], Schindler and Wiemers define the blinded exponent s k * with a blinding scalar R as:

Reduction of the Global Error.

  In[START_REF] Tumer | Analysis of decision boundaries in linearly combined neural classifiers[END_REF][START_REF] Tumer | Error correlation and error reduction in ensemble classifiers[END_REF], Tumer and Ghosh provide theoretical observations for analyzing the interest of ensembling to solve a classification problem. They analyze the classification errors that are added to the Bayes error (i.e. the lowest possible error rate for any classifier of a random outcome) for an ensemble model. Let E = {F Θ0 , F Θ1 , • • • , F Θ Nc-1 } be a set (or committee) of N c models (or members) with trainable parameter (Θ n ) 0≤n<Nc . In the following, F Θn will be denoted as F n . The parametric models are assumed to have the same d error rate such that E add denotes the expected added error of the individual members included in E. In[START_REF] Tumer | Analysis of decision boundaries in linearly combined neural classifiers[END_REF][START_REF] Tumer | Error correlation and error reduction in ensemble classifiers[END_REF], Tumer and Ghosh show that the expected added error of the ensemble committee, denoted E add,ens , can be expressed as:

  In Equation 8.3, the relevance M I(F n ; Y ) highlights the dependence of a learner F n ∈ E and a sensitive variable Y . Following[START_REF] Zhou | Multi-information ensemble diversity[END_REF][START_REF] Zhou | Ensemble Methods: Foundations and Algorithms[END_REF], this term gives a bound on the accuracy of the individual parametric models. In Chapter 7, we extend this result by demonstrating that this term, also referred as the Ranking Loss, is defined as an upper bound on the success rate related to each individual parametric model. Hence, a large relevance is preferred to maximize the performance of the ensemble model. As mentioned in Chapter 7, minimizing the ranking loss is equivalent to maximizing an approximation of the mutual information M I(F n ; Y ). The minimization of this loss function is exactly what the relevance quantifies in[START_REF] Brown | An information theoretic perspective on multiple classifier systems[END_REF]. Thus, given a profiling set I p of N p pairs (t i , y i ) 0≤i≤Np , a parametric model F n and a number of attack traces N a such that N a |N p , we define the empirical risk combined with the Relevance Loss function

	as:
	R(L ReL

  Through our individual losses provided in Equation 8.4, Equation 8.5 and Equation 8.6, we formulate an Ensembling Loss (EL) that maximizes an estimation of the mutual information between an ensemble E and a label Y . Indeed, based on Equation 8.3, this new empirical risk can be expressed as below. (Empirical Risk combined with the Ensembling Loss). Given a profiling set T of N p pairs (t i , y i ) 1≤i≤Np , a set of parametric models E = {F 0 , F 1 , • • • , F Nc-1 } and a number of attack traces N a such that N a |N p , we define the empirical risk combined with the ensembling loss function as:

	Definition 8.3.1.1

R(L Rel , L RedL , L CRL

  Remark 8.4.2. In[START_REF] Destouet | Wavelet scattering transform and ensemble methods for side-channel analysis[END_REF], Destouet et al. investigate a solution that consists in the aggregation of multiple models targeting different sensitive value (i.e. Hamming weight, first big-endian bit, identity). In this thesis, we assume that all the learners are trained on the same single label.In Subsection 8.4.1 (resp. Subsection 8.4.2), we evaluate the diversity of committee members depending on the loss used when the Secure RSA dataset (resp. Secure ECC dataset) is considered.

Table 8 .

 8 1: Evolution of accuracy depending on σ (30, 000 profiling traces & 3, 000 validation traces)

	α bit	σ	0	10 -3	10 -2	10 -1	1	6	8	10	50
	Negative Log-Likelihood 98.30% 97.60% 97.77% 96.33% 95.70% 92.50% 85.80% 80.60% 41.77%

Table 8 .

 8 2: Range of hyperparameters selection

		Values
	N filt.	{2, 4, 8, 16, 32, 64}
	Filter size	{1, 5, 11, 21, 43}
	N conv.blocks	{1, 2, 3, 4, 5}
	Pooling operation {Average, Max}
	Pooling stride	{2, 4, 6}
	N FC layers	{0, 1, 2, 3}
	N nodes per FC layers	{2, 4, 8, 16, 32, 64}

Table 8 .

 8 3: Performance evaluation depending on the diversity's type (Average over 10 physical traces of 1, 088 bits each). Green (resp. Red) cells are considered as practicable (resp. unpracticable) following the SOG-IS recommendations.

	Model	α label	α bit	bit	C N C	C 2 b	C AA	Training time (seconds)
	N LL 1	92.50%(±2.06%) 90.16%(±2.32%) 0.0984 500.08 108 102.74	86s
	RkL 1	94.03%(±1.85%) 91.26%(±2.21%) 0.0874 460.66 96 102.74	81s
	N LL 5	93.60%(±1.91%) 91.04%(±2.23%) 0.0896 467.39 98 102.74	450s
	RkL 5	94.33%(±1.81%) 91.66%(±2.16%) 0.0834 443.55 91	99.37	340s
	EL 5,III	95.19%(±1.67%) 92.45%(±2.07%) 0.0754 415.25 83	96.06	740s
	N LL 5,I	95.31%(±1.65%) 93.28%(±1.96%) 0.0672 381.96 74	92.43	688s
	RkL 5,I	95.93%(±1.55%) 94.48%(±1.79%) 0.0552 330.81 61	92.43	780s
	EL 5,I+III	96.57%(±1.42%) 95.49%(±1.62%) 0.0451 284.21 50	88.45	884s
	N LL 5,I+II	96.23%(±1.49%) 94.66%(±1.76%) 0.0534 322.58 59	88.45	2, 116s
	RkL 5,I+II	96.27%(±1.48%) 94.94%(±1.71%) 0.0506 310.01 56	88.45	1, 092s
	EL 5,I+II+III 97.33%(±1.26%) 96.96%(±1.34%) 0.0304 209.52 34	80.71	3, 392s

Table 8 .

 8 4: Evolution of accuracy depending on σ (20, 000 profiling traces & 2, 000 validation traces)

	α bit	σ	0	10	20	30	50	100
	Negative Log-Likelihood 99.43% 98.20% 93.63% 89.10% 83.87% 72.10%
	Ranking Loss		99.47% 99.00% 96.77% 92.60% 86.15% 74.30%

Table 8 .

 8 5: Performance evolution depending on the diversity applied (Average over 10 physical traces of 256 bits each). Green (resp. Red) cells are considered as practicable (resp. unpracticable) following the SOG-IS recommendations.

	Model	α bit	bit	C N C	C 2 b Training time (seconds)
	N LL 1	89.10%(±2.44%) 0.109 120.91 28	27s
	RkL 1	92.60%(±2.05%) 0.074	90.72 19	28s
	N LL 5	91.60%(±2.17%) 0.084 101.45 22	440s
	RkL 5	92.63%(±2.04%) 0.0737 90.72 19	387s
	EL 5,III	93.33%(±1.95%) 0.0667 86.98 18	588s
	N LL 5,I+II	94.13%(±1.84%) 0.0587 79.24 16	618s
	RkL 5,I+II	94.70%(±1.75%) 0.053	71.1	14	750s
	EL 5,I+II+III 95.60%(±1.60%) 0.044	62.50 12	884s

  Traditionally, the methods considered in ensembling are the Boostrap Aggregating[START_REF] Breiman | Bagging predictors[END_REF], also known as Bagging, and the Boosting[START_REF] Freund | Experiments with a new boosting algorithm[END_REF][START_REF] Chen | Xgboost: A scalable tree boosting system[END_REF] techniques. Through this discussion, we evaluate the benefits of these techniques in addition to the current ensemble models. The bagging and boosting approaches are not new in side-channel context [MPP16, PSK + 18, PCP20]. While these algorithms are essentially performed with Random Forest (RF)[START_REF] Breiman | Random forests[END_REF], it can also be proposed for enhancing the performance of neural networks. The details on the hyperparameters selection are provided in Appendix F TableF.3 for the bagging selection and in Appendix F TableF.4 for the eXtreme Gradient Boosting (XGBoost)[START_REF] Chen | Xgboost: A scalable tree boosting system[END_REF] and the CNN-XGBoost [RGL+ 17]. The best results for all the models are reported in Table8.6. In our experiment, this table illustrates that bagging and XGBoost do not provide a clear advantage when they are added to the standard proposition introduced in Table8.3. However, if an improvement is observed, these algorithms can be combined with those introduced in this chapter (i.e. Type I+II+III diversity) in order to generate a more powerful ensemble model.

Table 8 .

 8 6: α label for each ensemble method (Average over 10 physical traces of 1, 088 bits each)

			Bagging		XGBoost & CNN-XGBoost
		RM SE	N LL 5	RkL 5	RM SE	N LL 5	RkL 5	EL 5,III
	α label	84.97% (±2.80%) (±1.99%) (±1.90%) (±2.19%) (±1.90%) (±1.84%) (±1.74%) 93.02% 93.70% 91.43% 93.70% 94.13% 94.77%
	Training time (seconds)	4, 073s	315s	415s	7, 597s	481s	372s	775s

Table 8 .

 8 7: α label for each combination technique (Average over 10 physical traces of 1, 088 bits each)

		N LL 5	RkL 5	EL 5,III
	Averaging 93.60%(±1.91%) 94.33%(±1.81%) 95.19%(±1.67%)
	Voting	93.63%(±1.91%) 94.30%(±1.81%) 95.16%(±1.68%)

Table 8 .

 8 8: Performance evolution depending on the committee members (Average over 10 physical traces of 1, 088 bits each)

	Model	α label	α bit	bit	C N C

C 2 b C AA Training time (seconds)

	EL 2,I+II+III	96.77%(±1.38%) 95.12%(±1.69%) 0.0488 301.54 54 88.45	1, 482s
	EL 5,I+II+III	97.33%(±1.26%) 96.96%(±1.34%) 0.0304 209.52 34 80.71	3, 392s
	EL 10,I+II+III 97.43%(±1.24%) 97.33%(±1.26%) 0.0267 189.23 30 80.71	5, 460s
	EL 16,I+II+III 97.90%(±1.12%) 97.10%(±1.31%) 0.0290 199.47 32 80.71	6, 942s
	EL 32,I+II+III 97.37%(±1.25%) 96.67%(±1.40%) 0.0333 225.26 37 84.03	9, 548s

  Through this study, we design a new feature selection part in order to focus the interest of the network on the points of interest only without altering the performance of the model. In comparison with the state-of-the-art results, our neural network architecture suggests that a low complexity neural network can be sufficient to defeat implementations considering first-order Boolean masking schemes and/or random delay effect. Recently, this observation has been validated on other countermeasures namely code polymorphism [MBC + 20], Shamir's Secret Sharing mechanism[START_REF] Maghrebi | Assessment of common side channel countermeasures with respect to deep learning based profiled attacks[END_REF][START_REF] Maghrebi | Deep learning based side channel attacks in practice[END_REF], 1-amongst-N countermeasure[START_REF] Maghrebi | Assessment of common side channel countermeasures with respect to deep learning based profiled attacks[END_REF][START_REF] Maghrebi | Deep learning based side channel attacks in practice[END_REF] and shuffling protection[START_REF] Maghrebi | Assessment of common side channel countermeasures with respect to deep learning based profiled attacks[END_REF][START_REF] Maghrebi | Deep learning based side channel attacks in practice[END_REF]. However, instead of the CNN, other neural network architectures (e.g. ResNets, RNNs, U-Nets, LSTM) have not been widely investigated in the side-channel context. Even if those approaches show promising results [ZS19, Mag19a, MS21], their benefits are still unknown in comparison with the convolutional neural networks.

Perspective 9.1.4 (Neural Network Architectures). Assessing the benefits of other neural network architectures in comparison with convolutional neural networks.

Table 9 .

 9 1: cVAE-ST vs. Discriminative models from a SCA perspective.

	cVAE-ST Discriminative models

Table A

 A

		.1: SNR value for each scenario
		SNR value over 10, 000 simulated traces
		σ 2 = 0.1 σ 2 = 1	σ 2 = 10
	Scenario 1 258.51	2.578	0.0577
	Scenario 2	50.58	0.509	0.0319
	Scenario 3	51.28	0.549	0.0368
	Scenario 4	32.38	0.346	0.0262	Figure A.1: Legend.
	σ 2 = 0.1		σ 2 = 1	σ 2 = 10
	Encoder	Vector basis		Vector basis	Vector basis
	Decoder	Vector basis		Vector basis	Vector basis

Dans un premier temps, nous lions les paradigmes d'apprentissage profond et d'attaques par canaux auxiliaires via l'identification d'une approche commune, dite générative. Notre travail permet de corréler un ensemble de problématiques connues par la communauté (réduction de dimensionnalité, resynchronisation, sélection de points d'intérêt). Par la construction d'une nouvelle architecture, appelée cVAE-ST, nous montrons que l'adaptation d'approches génératives est une première étape vers une meilleure compréhension et interprétabilité des résultats. Cela permet de réduire les limitations de "boites noires" et ainsi, de résulter en une meilleure évaluation de sécurité. Cependant, nous montrons que ces approches ont encore quelques limitations pratiques. Considérées comme une alternative concrète aux cVAE-ST, nous nous intéressons dans un second temps aux approches discriminatives. En particulier, nous définissons une méthodologie de construction d'architecture à faible complexité, dont les résultats empiriques obtenus sur l'ensemble des bases de données publiques, sont, aujourd'hui, les meilleurs de l'état de l'art. Leur faible complexité permet de réduire considérablement la phase de conception des algorithmes, souvent exploratoire, et ainsi, réduire le temps nécessaire d'une évaluation de sécurité. Cependant, dans le cadre d'une évaluation, il est important de générer des algorithmes convergeant vers une solution optimale.Dans un troisième temps, nous nous focalisons donc sur l'optimalité des attaques et introduisons une nouvelle métrique d'apprentissage spécifique au contexte des attaques par canaux auxiliaires. Appelée Ranking Loss, cette métrique vise à améliorer les performances des algorithmes en maximisant le taux de succès d'une attaque et de se rapprocher des performances théoriques optimales. Finalement, nous caractérisons une nouvelle métrique d'apprentissage spécifique au contexte d'Ensembling. Appelée Ensembling Loss, cette métrique combine plusieurs algorithmes afin d'accroître leur complémentarité et ainsi, améliorer les performances d'une attaque par canaux auxiliaires. D'après les critères d'évaluation sécuritaire, cette dernière étude permet de démontrer qu'un faible gain en performance peut remettre en cause les conclusions relatives à la robustesse d'un système embarqué contre des attaques par canaux auxiliaires.

c Artificial Intelligence is a wide-ranging branch of computer science concerned with building algorithms capable of performing tasks that typically require human intelligence (e.g. image classification, speech recognition, computer vision, etc).

b In[START_REF] Durvaux | From improved leakage detection to the detection of points of interests in leakage traces[END_REF], Durvaux and Standaert propose an alternative by applying the Welch's T-test on fixed vs. fixed sets. This solution is beneficial from a sampling complexity perspective.c In[START_REF] Standaert | How (not) to use welch's t-test in side-channel security evaluations[END_REF], Standaert extends this metric to protected implementations.

f We recall that the signal-to-noise ratio (see Equation 3.2) quantifies the dependence between the time samples and the targeted sensitive information.g The interested readers may refer to https://newae.com/tools/chipwhisperer/.

h http://www.dpacontest.org/v4/42_traces.php i https://github.com/AESHD/AES_HD_Dataset j https://github.com/ikizhvatov/randomdelays-traces

d This process is known as an epoch. In other words, it refers to the number of iterations processed by the gradient descent in order to consider the whole training set.

that satisfy Theorem 5.1.1.1. This process is described in Subsection 5.1.2.

k The readers must be aware that this observation cannot be generalized on all implementations and would benefit from further investigations.

l This choice is motivated by our willingness to fit with the stochastic attacks and thus, bridging the deep learning with classical profiled side-channel attacks.

g This term has been defined in Definition 4.3.2.5.

h We recall that this term has been introduced in Definition 4.2.2.2. i Here, the robustness refers to the ability of the neural network to provide the same performance while being trained on datasets which partially differ.

j As remainder, in this manuscript, a convolutional block is characterized by one convolutional layer followed by a pooling layer.

k While this statement can be justified from a Machine Learning perspective[START_REF] Ng | On discriminative vs. generative classifiers: A comparison of logistic regression and naive bayes[END_REF], it can be qualified in Side-Channel context as some simplification can be made (see Equation 3.4).

e As mentioned in Definition 7.1.2.1, the output score can also be characterized by P(Y) in order to penalize the network with respect to the normalized probability distribution.

g The notation M I(Y, T, Θ) differs from [BHM+ 19]. In this manuscript, this notation is used to differentiate the probability distribution obtained from F Θ,N LL and a ranking model. It notably useful to denote the inequality introduced in Equation 7.15.

st -order masking and random-delay countermeasures. Figure7.3b, Figure7.4a and Figure7.4b provide a comparison between models trained with the different losses for synchronized and desynchronized leakage traces. In Figure7.3b, when the model is trained with the ranking loss, only

h Note that models trained with the cross-entropy ratio did not converge when desynchronization 100 is considered.

d This strong hypothesis is proposed by Tumer and Ghosh in[START_REF] Tumer | Analysis of decision boundaries in linearly combined neural classifiers[END_REF][START_REF] Tumer | Error correlation and error reduction in ensemble classifiers[END_REF] to illustrate the benefits of the ensembling approach.

e In our context, minimizing the conditional entropy H(Y |T ) is equivalent to minimizing H(Y |F n ) as the related penalization term is similar.

f The interested readers may refer to [CCC + 19, Section 2.3] to get an insight into how this conversion should be performed.

c Here, the score is characterized by the probability provided by the parametric model or the ensemble model.

Acknowledgments

Chapter 7 Ranking Loss: Maximizing the Success Rate

As defined in Definition 3.3.1.4, the optimal distinguisher rule retrieves the secret key, manipulated by the cryptographic module, from the true unknown conditional probability Pr [T|Y ] or Pr[Y |T]. Thus, the Evaluator has to construct a Θ-parametric model that approximates such solutions through the use of an adequate loss function. While finding this learning metric is considered as a non-trivial task [PHJ + 18], this chapter proposes to reduce this gap by deriving a new loss function from the Learning to Rank field. After a short introduction of this field, we detail its link with the success rate metric (see Equation 3.6). By adapting this new loss function, called Ranking Loss (RkL), for the side-channel context, we force the learning algorithm to explicitly select the model that optimizes the attack performance by extracting the leakage traces' information. Then, a theoretical comparison with the negative log-likelihood loss function is proposed. Finally, experimental results validate our theoretical observations and suggest that the model trained with the ranking loss performed, at least, similarly to a model trained with the negative log-likelihood loss function. The solutions proposed in this chapter have been presented at CHES and published in the journal IACR TCHES [ZBD + 20b]. traces may be too low to estimate the perceived information properly. Consequently, this error can be quantified for a given number of profiling leakage traces.

• Optimization error -it characterizes the error induced by the learning process, such as the choice of a restricted model space F that does not necessarily contain the optimal model F * , and the ability of the gradient-based algorithm (e.g. stochastic gradient descent, mini-batch gradient descent, Adam optimizer) to converge towards the optimal solution.

Section 7.3 emphasizes the impact of these error terms on different datasets. First, this section recalls the gap between the negative log-likelihood loss function and the mutual information. Then, we explain the theoretical benefits of the ranking loss through an error analysis between the ranking loss, the negative log-likelihood and the mutual information. To assess the quality of the ranking loss, we have to evaluate the tightness of the inequalities defined in Equation 7.15.

To ease the following analysis, let P I(Y, T, Θ) and M I(Y, T, Θ) be defined as follows g :

Error Analysis of the negative log-likelihood. Proposed in [START_REF] Masure | A comprehensive study of deep learning for side-channel analysis[END_REF], this error decomposition establishes the gap between the mutual information and the perceived information that we are maximizing with the negative log-likelihood. To facilitate the comparison of our results with [START_REF] Masure | A comprehensive study of deep learning for side-channel analysis[END_REF], we use the same notations. Let Θ denotes an estimation of the trainable parameters when a gradient descent-based algorithm is used (e.g. stochastic gradient descent, mini-batch gradient descent) and Θ * the optimal trainable parameters obtained when a global minimum of the loss function is reached and such that the optimal model F * is selected. According to Equation 7.15, this error gap can be decomposed into the three errors previously introduced: such that Equation 7.16 defines the optimization error, Equation 7.17 defines the estimation error and Equation 7.18 denotes the approximation error. The approximation error is negligible if and only if the Evaluator obtains the true distribution Pr[Y |T] through the empirical risk minimization. Through Section 7.3, we will show that, even in the simplest case, the approximation error can have a huge impact on the training process such that some irrelevant features could be defined as points of interest. Consequently, these errors could highly impact the performance of the network.

Error analysis of the ranking loss. In order to complete the latter analysis, we estimate the errors generated when M I and M I are taken into consideration. Through Equation 7.15, it can be easily observed that the gap between the estimated and the true mutual information can be decomposed into an estimation error and an optimization error as below:

sensitive variable Y can be rewritten as follows:

This result is consistent with Equation 8.2.

The relevancy computes the mutual information between the n th parametric model of E and the target Y . The redundancy is independent of the class label Y and measures the interactions between all the models. Hence a large Nc-1 n=1 En⊆E M I({E n }) indicates strong correlations between the parametric model induced in E n . Finally, Nc-1 n=1 En⊆E M I({E n }|Y ) indicates that a strong class-conditional correlation is needed to perform an efficient ensemble model. However, from a practical perspective, it is quite difficult to estimate higher-order interaction information. Currently, there is no effective computational approach in the literature. Hence, Brown proposes to simplify Equation 8.2 by considering only pairwise components as follows [START_REF] Brown | An information theoretic perspective on multiple classifier systems[END_REF]: However, from a practical perspective, the Evaluator cannot directly compute M I(E; Y ) because it is intractable. Thus, we have to find a loss function that penalizes a set of parametric models included in E such that an approximation of this mutual information M I(E; Y ) is maximized.

The following section proposes a solution to this issue.

Ensembling Loss: A Pairwise Ensemble Diversity Metric

This section presents our solution: the Empirical Risk combined with the Ensembling Loss. In Subsection 8.3.1, we first define three sub-empirical risks that are combined with three new losses, namely Relevance Loss, Conditional Redundancy Loss and Redundancy Loss, derived from the mutual information ensemble diversity. This decomposition allows us to define the Ensembling Loss as a diversity learning metric. Then, Subsection 8.3.2 validates the theoretical aspects of the ensembling loss through visualization techniques.

Ensembling loss combined with type I diversity. As mentioned in Subsection 8.2.1, the type I diversity refers to the heterogeneity between the committee members' structure. This diversity is employed by Perin et al. [START_REF] Perin | Strength in numbers: Improving generalization with ensembles in machine learning-based profiled sidechannel analysis[END_REF] to argue the generalization improvement induced by this ensemble method. In the following, we propose to combine the type I diversity with the different loss functions to evaluate the resulted gain in attack complexity. For that purpose, we randomly generate 5 networks with a wide range of hyperparameters (details are provided in Appendix F Table F.1). In [START_REF] Zhou | Ensemble Methods: Foundations and Algorithms[END_REF], Zhou recommends the configuration of heterogeneous neural network architectures with high individual performance. Even if this solution can be intuitive, this is not necessarily the best one as discussed in Subsection 8.3.2. From a diversity perspective, using efficient heterogeneous neural networks increase the uncorrelated errors. Through Figure 8.5, combining the type I diversity with the ensembling loss reduces the overall κ-statistic metric. Following Definition 8.3.2.2, this observation confirms the gain in diversity. This result can also be verified with the disagreement measure (see Figure 8.6). From a performance perspective, the individual committee members do not exceed 94.33% for retrieving the bits of blinding exponent when the ranking loss is considered (see Appendix F Table F.1). However, applying the ensembling loss adjusts the efficiency of each learner to increase their complementarity. Indeed, though

Additional Simulations on Leakage Model Estimation

To evaluate the benefits of the cVAE-ST to retrieve the correct basis, we simulate four sets of 10, 000 leakage traces through different scenarios (9, 000 for the profiling phase and 1, 000 for the validation phase):

• Scenario 1 -We assume that each leakage trace is configured by 3 time samples such that only 1 point of interest is considered. The leakage model induces the maximum amount of interactions between bits (i.e. G 9 ) such that all bits influencing the leakage model have the same weighting. Hence, the i th time sample of the simulated trace T is defined as follows:

where

denotes the b th bit of the output of the Sbox, and Z[i] is a Gaussian noise following N (0, σ 2 ) such that σ 2 ∈ {0.1, 1, 10}.

• Scenario 2 -We assume that each leakage trace is configured by 4 time samples such that only 2 points of interest are considered. The leakage model does not induce interactions between bits (i.e. d = 1 and G 2 ) but differs from the location of the points of interest. Hence, the i th time sample of the simulated trace T is defined as follows:

where

• Scenario 3 -We assume that each leakage trace is configured by 3 time samples such that only 1 point of interest is considered. The leakage model does not induce interactions between bits (i.e. d = 1 and G 2 ) such that all bits influencing the leakage model have the same weighting. Hence, the i th time sample of the simulated trace T is defined as follows:

Encoder

Vector basis Vector basis Vector basis

Decoder

Vector basis Vector basis Vector basis

Encoder

Vector basis Vector basis Vector basis

Decoder

Vector basis Vector basis Vector basis

Encoder

Vector basis Vector basis Vector basis

Decoder

Vector basis Vector basis Vector basis

Appendix B

Impact of α on the Empirical Risk combined with the Ranking Loss

Through this appendix, we evaluate the impact of α on the empirical risk combined with the ranking loss. Given a profiling set I p of N p pairs (t i , y i ) 0≤i≤Np , a Θ-parametric model F Θ and a number of attack traces N a such that N a |N p , the empirical risk combined with ranking loss function is defined as:

where

defines the output score of the hypothesis k ∈ |K| for a given plaintext (x j ) 1≤j≤Na while α denotes one hyperparameter related to the sigmoid and approximates the identity function needed for estimating the success rate.

We select a wide range of α values in order to efficiently evaluate the impact of this optimizer hyperparameter on the training process.

Bounds in Learning to Rank Metrics

In [CLL + 09a], Chen et al. reveal the relationship between classical information retrieval measures (i.e. MAP, DCG, NDCG) and the loss functions used in "Learning to Rank" approach (i.e. Pairwise and Listwise losses). In this appendix, we exploit their results in order to argue the inequalities introduced in Equation 7.6 and Equation 7.7. Let s Na (g Na , i) be the score associated with the key hypothesis ranked at the i th position in the ranking vector g Na , introduced in Subsection 3.3.4. In [CLL + 09a], the authors define a loss function, called essential loss, that characterizes the sum of the classification error involved during the training process,

First, the essential loss can be defined as an upper bound of (1 -M AP @|K|) where |K| denotes the number of key hypotheses and M AP @|K| is the mean average precision over the top |K| relevant position in g.

Theorem C.1 (From item (2) of Theorem 1 [CLL + 09a]). Given a 2-level rating data with n 1 elements with the label 1 and n 1 > 1, then, the following inequality holds,

Proof. See the proof of Theorem 1 in [CLL + 09a] Following Chen et al., the essential loss can also be defined as a lower bound of many ranking loss functions (e.g. pairwise loss or listwise loss).

Theorem C.2 (From item (1) of Theorem 2 [CLL + 09a]). The pairwise loss function is an upper bound of the essential loss such as,

Proof. See the proof of Theorem 2 in [CLL + 09a] Interestingly, combining the results obtained in C.1 and C.2 is helpful to distinguish a relation between the classical learning to rank loss functions and the information retrieval measures used to evaluate the training process. Indeed, this combination gives us the following result,

where gr(i) defines the grade associated to the i th key hypothesis (i.e. 0 or 1).

Appendix D Approximation of the Pairwise Mutual Information Ensemble Diversity

In [START_REF] Brown | An information theoretic perspective on multiple classifier systems[END_REF], Brown proposes a solution to compute the mutual information between an ensemble model composed by a set of parametric models E = {X 0 , X 1 , . . . , X Nc-1 } and a set of true unknown labels Y . However, as mentioned in Subsection 8.2.2, it is quite difficult to estimate higher-order interaction information. Thus, Brown proposes to simplify Equation 8.2 by considering only pairwise components as follows: In order to achieve a general-purpose estimator, we base our propositions on the characterization of the mutual information as the Kullback-Leibler (KL-) divergence [START_REF] Kullback | On information and sufficiency[END_REF] between the joint distribution and the product of the marginals such that, given two random variables X and Y , we have:

Furthermore, the conditional mutual information of random variables X and Y given Z can be expressed as follows:

Based on these definitions, we develop a loss function for each term of Equation D.1.

Approximation of M I(F n ; Y ). The mutual information M I(F n ; Y

) is used to compute the relevancy term (i.e. Nc-1 n=0 M I(F n ; Y )) such that, following Equation D.1 and Equation D.2, we want to maximize the probability of Y knowing F n . If F n : T → S, such that S ⊆ R |Y| , we have to solve a similar problem to the ranking loss defined in Chapter 7. Thus, given a profiling set I p of N p pairs (t i , y i ) 0≤i≤Np , a parametric model F n and a number of attack traces N a such that N a |N p , we define the empirical risk combined with the Relevance Loss function as:

defines the output score of the hypothesis k ∈ |K| for a given plaintext (x j ) 1≤j≤Na while α approximates the sigmoid function needed for estimating the success rate. The interested readers may refer to Subsection 7.1.2 in order to obtain more details on Equation D.4.

Approximation of M I(F n ; F m |Y ). The conditional interaction information M I(F

is used to compute the conditional redundancy term (i.e.

Nc-2 n=0

Nc-1 m=n+1 M I(F n ; F m |Y )), such that, following Equation D.1 and Equation D.3, we want to maximize the probability of observing F n and F m knowing the sensitive variable Y . This probability always equals 1 if F n and F m provide the same score related to the class Y . Consequently, if F n : T → S and F m : T → S, such that S ⊆ R |Y| , we want to find a solution that maximizes Pr[s Na,i (F n , k * ) = s Na,i (F m , k * )]. In other words, maximizing an approximation of M I(F n ; F m |Y ) consists in minimizing the distance between the scores s Na,i (F n , k * ) and s Na,i (F m , k * ). Following [IW18, Section 2.3], the probability Pr[s Na,i (F n , k * ) = s Na,i (F m , k * )] can be approximated as follows:

such that the parameters σ = 1 √ 2π and µ = 0 respect the condition Pr [s Na,i (F n , k * ) = s Na,i (F m , k * )] = 1 if and only if |s Na,i (F n , k * ) -s Na,i (F m , k * )| = 0. Thus, Equation D.5 can be rewritten as follows:

Then, similarly to the ranking loss, we apply the binary cross-entropy in order to penalize the deviation of the model probabilities from the desired prediction. In other words, we want to penalize the loss function when s Na (F n , k * ) differs from s Na (F m , k * ). Thus, we define the conditional redundancy loss function L CRL (F n , F m , Y ) as:

where PFn,Fm,k * = Pr [s Na (F n , k * ) = s Na (F m , k * )] and P Fn,Fm,k * defines the true unknown probability that s Na (F n , k * ) equals s Na (F m , k * ).

Similarly to the ranking loss, we assume that P Fn,Fm,k * is deterministically known such that, P Fn,Fm,k * = 1 2 (1 + rel Fn,Fm,k * ) where rel Fn,Fm,k * ∈ {-1, 1} defines the relation between s Na (F n , k * ) and s Na (F m , k * ) such that rel Fn,Fm,k * = 1 if s Na (F n , k * ) equals s Na (F m , k * ) and rel Fn,Fm,k * = -1 otherwise. As we want to force the equality between s Na (F n , k * ) and s Na (F m , k * ), we assume that P Fn,Fm,k * = 1. From Equation D.6 and Equation D.7, we can deduce the following conditional redundancy loss function:

where µ quantifies the impact of the diversity term during the training process. We normalize each term of the empirical risk to reduce the impact of exploding gradient. Appendix E highlights the benefits of each individual loss from a training perspective. Through this study, the reader can understand how the network would train if the conditional redundancy loss or the redundancy loss is individually used.

Appendix E t-SNE Ensembling Loss

APPENDIX E. T-SNE ENSEMBLING LOSS

In Equation 8.6, the Redundancy Loss function minimizes Pr [F m |F n ] which defines the output probability of the model F m given F n . From an information theory perspective, this can be considered as a minimization of H (F m |F n ) In other words, we want to maximize the inter-class variance between the models F m and F n . Hence, adding the redundancy loss to the ranking loss should increase the distance between each cluster by diversifying the features representation of each cluster. This observation can be validated thanks to Figure E.1. Indeed, the third t-SNE visualization illustrates a model trained with the ranking and the redundancy losses. In comparison with the first t-SNE visualization, we can highlight the benefits of the redundancy loss to increase the distance between each cluster and make the FN and FP less persistent. However, in some extent, this approach generates sparse representation of a given cluster and also reduces the confidence of the networks on some TP. Hence a good trade-off has to be found between maximizing the confidence of the TP (i.e. conditional redundancy loss) and minimizing the persistence of the FP (i.e. redundancy loss). The Ensembling Loss aims at finding this solution for given α, β, γ, µ values (see Equation D.9). In Figure E.1, the combination of the relevance loss, the conditional redundancy loss and the redundancy loss creates three separate clusters. When the network is confident in its predictions, it will assign the related examples to the correct cluster. Thanks to the conditional redundancy loss, we know that the predictions with a high level of confidence will be assigned to the same compact cluster. However, the ensembling loss also creates some connections between the clusters which seem defined by the data uncertainty. This result tends to reduce the number of consistent FP and FN such that few errors can be detected on each cluster in contrast with the ranking loss. This observation highlights the benefits of the redundancy loss during the training process. In Figure E.1, the ensembling loss finds a good trade-off between maximizing the confidence of the TP and minimizing the persistence of the FP.

Appendix F Neural Network Architectures for Enhancing Diversity

Type I diversity. The architectures used for the type I diversity are randomly selected such that the number of convolutional layers and fully-connected layers (FC) do not exceed 2. Hence, we evaluate the type I diversity with the restriction of small network complexity. We select 5 neural network architectures with high individual α label value (i.e. ≥ 85%) to limit the impact of the outliers and preserve an overall good performance. All the architectures used for the type I diversity investigation are detailed in Table F.1.

Bagging and Boosting Hyperparameters Selection

The hyperparameter selection is performed on Random Forest (RF) [START_REF] Breiman | Random forests[END_REF] and Convolutional Neural Networks (CNN). Table F.3 (resp. Table F.4) identifies the ranges selected to configure the bagging (resp. boosting) models. Let N split be the minimum number of samples required to split an internal node and the boostraping factor r denotes the number of side-channel traces n used to train a classifier (i.e. n = r • N p with N p = 30, 000). For the Random Forest models, the nodes are expanded until all leaves contain less than N split samples. Learning rate {10 -6 , 10 -5 , 10 -4 , 10 -3 , 10 -2 , 10 -1 , 1}