Algorithm‐level evaluation of DPA resistance to cryptosystems

Abstract

AbstractPaul Kocher has proposed a cryptanalysis technique called differential power analysis (DPA), in which attackers derive secret information such as private keys from a statistical analysis of the power consumption by the target device. There is now a demand to evaluate the DPA resistivity of a cryptographic device before the device is actually created. In this paper, we focus on simulating DPA with high speed at algorithm level in upstream of the design process. Messerges used a power leakage model to obtain power consumption from Hamming weight for proof of high‐order DPA. However, the correctness of the model has not been verified. In this paper, we verify that difference of power consumption in DPA can be obtained from the power leakage model by investigating the cause of power consumption of CMOS circuits and transition probability of logic gates. The verification is performed by means of a circuit simulator. Next we describe a method of performing algorithm‐level simulation which calculates power consumption using the power leakage model. We illustrate the effectiveness of the method by applying it to DPA resistivity evaluation of DES implementation. © 2008 Wiley Periodicals, Inc. Electr Eng Jpn, 165(3): 37– 45, 2008; Published online in Wiley InterScience (www.interscience.wiley.com). DOI 10.1002/eej.20611