Multi-Tuple Leakage Detection and the Dependent Signal Issue - - PowerPoint PPT Presentation
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Multi-Tuple Leakage Detection and the Dependent Signal Issue Olivier Bronchain Tobias Schneider Fran cois-Xavier Standaert CHES 2019, Atlanta, USA Olivier Bronchain
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Olivier Bronchain Tobias Schneider Fran¸ cois-Xavier Standaert CHES 2019, Atlanta, USA
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 1 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 2 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 3 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Crypto P’s C’s
Encryption on physical devices:
◮ Standard utilization Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 4 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Crypto P’s C’s l’s
Physical Trace
Encryption on physical devices:
◮ Standard utilization ◮ But with any physical signals Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 4 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Crypto P’s C’s l’s
Physical Trace
Encryption on physical devices:
◮ Standard utilization ◮ But with any physical signals ◮ Possibly containing secret information Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 4 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Crypto P’s C’s l’s
Physical Trace
Encryption on physical devices:
◮ Standard utilization ◮ But with any physical signals ◮ Possibly containing secret information
Side-channel Attacks:
◮ Known to be hard to prevent ◮ Hard to evaluate as well Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 4 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Crypto P’s C’s l’s
Physical Trace
Encryption on physical devices:
◮ Standard utilization ◮ But with any physical signals ◮ Possibly containing secret information
Side-channel Attacks:
◮ Known to be hard to prevent ◮ Hard to evaluate as well
Two evaluation approaches:
◮ Attack based ◮ Leakage detection Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 4 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Can directly mount attacks:
Crypto P’s C’s
= ?
l’s
Physical Trace
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 5 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Can directly mount attacks:
Crypto P’s C’s
= ?
l’s
Physical Trace
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 5 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Can directly mount attacks:
Crypto P’s C’s
= ?
l’s
Physical Trace
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 5 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Can directly mount attacks:
Crypto P’s C’s
= ?
l’s
Physical Trace This requires:
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 5 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Leakage detection searches for dependency between manipulated data and physical traces.
Crypto
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 6 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Leakage detection searches for dependency between manipulated data and physical traces.
Crypto P1 or P2 C1 or C2
1 or 2 ◮ Feed the core with two different
sets of inputs
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 6 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Leakage detection searches for dependency between manipulated data and physical traces.
Crypto P1 or P2 C1 or C2
1 or 2 ◮ Feed the core with two different
sets of inputs
◮ Record the corresponding traces Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 6 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Leakage detection searches for dependency between manipulated data and physical traces.
Crypto P1 or P2 C1 or C2
1 or 2 ◮ Feed the core with two different
sets of inputs
◮ Record the corresponding traces ◮ Observe differences between the
two sets
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 6 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Leakage detection searches for dependency between manipulated data and physical traces.
Crypto P1 or P2 C1 or C2
1 or 2
How does it compare with attack based evaluations:
◮ Shortened measurement period
(Possibly)
◮ No skilled/expert knowledge Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 6 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Leakage detection searches for dependency between manipulated data and physical traces.
Crypto P1 or P2 C1 or C2
1 or 2
How does it compare with attack based evaluations:
◮ Shortened measurement period
(Possibly)
◮ No skilled/expert knowledge
A good first check but:
◮ Risk of false positives and false
negatives
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 6 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 7 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Find a difference between the two sets: .
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 8 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Find a difference between the two sets:
.
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 8 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Find a difference between the two sets:
Distributions
.
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 8 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Find a difference between the two sets:
Distributions Statistical Test
.
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 8 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Find a difference between the two sets:
Distributions Statistical Test
No difference found .
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 8 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Find a difference between the two sets:
Repeat with more measurements if needed
Distributions Statistical Test
No difference found .
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 8 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Find a difference between the two sets:
Repeat with more measurements if needed
Distributions Statistical Test
Difference found .
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 8 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Find a difference between the two sets:
Repeat with more measurements if needed
Distributions Statistical Test
Difference found The statistical test can search for difference in:
◮ Means with the Welch’s t-test ◮ Distributions with χ2-test ◮ . . .
.
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 8 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Find a difference between the two sets:
Repeat with more measurements if needed
Distributions Statistical Test
Difference found The statistical test can search for difference in:
◮ Means with the Welch’s t-test =
⇒ Most popular
◮ Distributions with χ2-test ◮ . . .
.
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 8 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
The traces contain multiple points in time:
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 9 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
The traces contain multiple points in time:
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 9 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
The traces contain multiple points in time:
t-testt-testt-testt-testt-testt-testt-testt-test Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 9 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
The traces contain multiple points in time:
t-testt-testt-testt-testt-testt-testt-testt-test No No No No No No No No Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 9 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
The traces contain multiple points in time:
t-testt-testt-testt-testt-testt-testt-testt-test No No Yes No No No Yes No Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 9 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
The traces contain multiple points in time:
t-testt-testt-testt-testt-testt-testt-testt-test Yes No Yes No No Yes Yes No Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 9 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
The traces contain multiple points in time:
t-testt-testt-testt-testt-testt-testt-testt-test Yes No Yes No No Yes Yes No
Difference found if:
◮ At least one of the tests goes above a threshold Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 9 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
The traces contain multiple points in time:
t-testt-testt-testt-testt-testt-testt-testt-test Yes No Yes No No Yes Yes No
Difference found if:
◮ At least one of the tests goes above a threshold ◮ Selected thanks to:
◮ Desired confidence ◮ Number of considered time samples ◮ Assuming independence between them
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 9 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
t-testt-testt-testt-testt-testt-testt-testt-test Yes No Yes No No Yes Yes No
TVLA performs independent t-test:
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 10 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
t-testt-testt-testt-testt-testt-testt-testt-test Yes No Yes No No Yes Yes No
TVLA performs independent t-test:
◮ Impossible to take advantage of multivariate
leakage
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 10 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
t-testt-testt-testt-testt-testt-testt-testt-test Yes No Yes No No Yes Yes No
TVLA performs independent t-test:
◮ Impossible to take advantage of multivariate
leakage
◮ Could lead to reduced measurement period
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 10 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
t-testt-testt-testt-testt-testt-testt-testt-test Yes No Yes No No Yes Yes No
TVLA performs independent t-test:
◮ Impossible to take advantage of multivariate
leakage
◮ Could lead to reduced measurement period
Independence in the signal is usually not met:
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 10 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
t-testt-testt-testt-testt-testt-testt-testt-test Yes No Yes No No Yes Yes No
TVLA performs independent t-test:
◮ Impossible to take advantage of multivariate
leakage
◮ Could lead to reduced measurement period
Independence in the signal is usually not met:
◮ Wrong assumption while setting the threshold Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 10 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
t-testt-testt-testt-testt-testt-testt-testt-test Yes No Yes No No Yes Yes No
TVLA performs independent t-test:
◮ Impossible to take advantage of multivariate
leakage
◮ Could lead to reduced measurement period
Independence in the signal is usually not met:
◮ Wrong assumption while setting the threshold
◮ Hard to interpret results (especially negative ones)
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 10 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 11 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
t-testt-testt-testt-testt-testt-testt-testt-test Yes No Yes No No Yes Yes No
Approach:
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 12 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Multivariate statistical test
Approach:
◮ Replace the independent tests by a single one Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 12 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Multivariate statistical test
Single binary output
Approach:
◮ Replace the independent tests by a single one Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 12 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Multivariate statistical test
Single binary output
Approach:
◮ Replace the independent tests by a single one
Natural canditate: Hotelling’s T 2-test
◮ Do not assume independence ◮ Need to invert a covariance matrix
◮ Not always applicable
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 12 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Multivariate statistical test
Single binary output
Approach:
◮ Replace the independent tests by a single one
Natural canditate: Hotelling’s T 2-test
◮ Do not assume independence ◮ Need to invert a covariance matrix
◮ Not always applicable
Heuristic alternative: D-test
◮ Assume independence
◮ Hard to interpret results
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 12 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Density of informative points:
◮ The proportion of leaking points ◮ t-test showing difference with ∞ of measurements
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Density of informative points:
◮ The proportion of leaking points ◮ t-test showing difference with ∞ of measurements
t-test Density = 0.1
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 13 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Density of informative points:
◮ The proportion of leaking points ◮ t-test showing difference with ∞ of measurements
t-test Density = 0.2
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 13 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Density of informative points:
◮ The proportion of leaking points ◮ t-test showing difference with ∞ of measurements
t-test Density = 0.5
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 13 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Density of informative points:
◮ The proportion of leaking points ◮ t-test showing difference with ∞ of measurements
t-test Density = 0.9
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 13 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Density of informative points:
◮ The proportion of leaking points ◮ t-test showing difference with ∞ of measurements
t-test Density = 0.9
Typical settings:
◮ Protected software: low density, long
traces
◮ Hardware unprotected: high density,
short traces
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 13 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
From simulations with fixed trace length:
10 2 10 1 100 103 104TVLA Multi-Tuple
log( Density )
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 14 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
From simulations with fixed trace length:
10 2 10 1 100 103 104TVLA Multi-Tuple
log( Density ) log( # of measurements)
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 14 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
From simulations with fixed trace length:
10 2 10 1 100 103 104TVLA Multi-Tuple
log( Density ) log( # of measurements)
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 14 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
From simulations with fixed trace length:
◮ Both methods suffer from a low density
10 2 10 1 100 103 104TVLA Multi-Tuple
log( Density ) log( # of measurements) x4 x4
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 14 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
From simulations with fixed trace length:
◮ Both methods suffer from a low density ◮ Multi-Tuple more than the TVLA
10 2 10 1 100 103 104TVLA Multi-Tuple
log( Density ) log( # of measurements) x4 x4
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 14 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
From simulations with fixed trace length:
◮ Both methods suffer from a low density ◮ Multi-Tuple more than the TVLA
10 2 10 1 100 103 104TVLA Multi-Tuple
log( Density ) log( # of measurements) x4 x4
Reduced data complexity with higher density
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 14 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
From simulations with fixed density:
100 101 102 103 104 105 106 500 1000 1500 2000 2500 3000 3500TVLA Multi-Tuple
log( Trace length )
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
From simulations with fixed density:
100 101 102 103 104 105 106 500 1000 1500 2000 2500 3000 3500TVLA Multi-Tuple
log( Trace length ) # of measurements
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
From simulations with fixed density:
100 101 102 103 104 105 106 500 1000 1500 2000 2500 3000 3500TVLA Multi-Tuple
log( Trace length ) # of measurements
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
From simulations with fixed density:
◮ Both methods take advantage of longer traces
100 101 102 103 104 105 106 500 1000 1500 2000 2500 3000 3500TVLA Multi-Tuple
log( Trace length ) # of measurements
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
From simulations with fixed density:
◮ Both methods take advantage of longer traces ◮ Multi-Tuple gains more than the TVLA
100 101 102 103 104 105 106 500 1000 1500 2000 2500 3000 3500TVLA Multi-Tuple
log( Trace length ) # of measurements x4
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 15 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
From simulations with fixed density:
◮ Both methods take advantage of longer traces ◮ Multi-Tuple gains more than the TVLA
100 101 102 103 104 105 106 500 1000 1500 2000 2500 3000 3500TVLA Multi-Tuple
log( Trace length ) # of measurements x4
◮ Reduced data complexity with the number of time samples ◮ The jointly processed trace size is limited for Hotelling’s test because of
covariance matrix inversion (∼2000):
◮ Possibility to run multiple Hotelling’s tests in parallel
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 15 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Crypto P1 or P2 C1 or C2
1 or 2
Two extreme settings:
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 16 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Crypto P1 or P2 C1 or C2
1 or 2
Two extreme settings:
◮ White Box: everything is
known about the design
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 16 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Crypto P1 or P2 C1 or C2
1 or 2
Two extreme settings:
◮ White Box: everything is
known about the design
◮ Black Box: nothing is known
about the design
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 16 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Crypto P1 or P2 C1 or C2
1 or 2
Two extreme settings:
◮ White Box: everything is
known about the design
◮ Black Box: nothing is known
about the design
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 16 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
In White Box:
P1 or P2 C1 or C2
1 or 2
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 17 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
In White Box:
◮ Prior information about leaking points
P1 or P2 C1 or C2
1 or 2
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 17 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
In White Box:
◮ Prior information about leaking points
◮ Can reduce traces
P1 or P2 C1 or C2
1 or 2
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 17 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
In White Box:
◮ Prior information about leaking points
◮ Can reduce traces
◮ Can invert the covariance matrix (Hotelling’s T 2-test) ◮ High density
P1 or P2 C1 or C2
1 or 2
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 17 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
In White Box:
◮ Prior information about leaking points
◮ Can reduce traces
◮ Can invert the covariance matrix (Hotelling’s T 2-test) ◮ High density
P1 or P2 C1 or C2
1 or 2
As a result:
◮ Smaller measurement period ◮ Easy interpretation of the confidence (no ⊥
⊥ assumption)
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 17 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
In Black Box:
P1 or P2 C1 or C2
1 or 2
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 18 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
In Black Box:
◮ No prior information about leaking points
P1 or P2 C1 or C2
1 or 2
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 18 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
In Black Box:
◮ No prior information about leaking points
◮ Can’t reduce traces
P1 or P2 C1 or C2
1 or 2
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 18 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
In Black Box:
◮ No prior information about leaking points
◮ Can’t reduce traces
◮ Can’t always invert the covariance matrix
P1 or P2 C1 or C2
1 or 2
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 18 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
In Black Box:
◮ No prior information about leaking points
◮ Can’t reduce traces
◮ Can’t always invert the covariance matrix ◮ Fixed density
P1 or P2 C1 or C2
1 or 2
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 18 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
In Black Box:
◮ No prior information about leaking points
◮ Can’t reduce traces
◮ Can’t always invert the covariance matrix ◮ Fixed density
P1 or P2 C1 or C2
1 or 2
As a result:
◮ Possibly larger measurement period Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 18 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
In Black Box:
◮ No prior information about leaking points
◮ Can’t reduce traces
◮ Can’t always invert the covariance matrix ◮ Fixed density
P1 or P2 C1 or C2
1 or 2
As a result:
◮ Possibly larger measurement period ◮ Independent assumption needed Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 18 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
In Black Box:
◮ No prior information about leaking points
◮ Can’t reduce traces
◮ Can’t always invert the covariance matrix ◮ Fixed density
P1 or P2 C1 or C2
1 or 2
As a result:
◮ Possibly larger measurement period ◮ Independent assumption needed
◮ Heuristic required for confidence level interpretation:
◮ TVLA: too conservative ◮ D-test: too optimistic
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 18 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 19 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Physical signals are not likely to be independent across time
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 20 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Physical signals are not likely to be independent across time
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 20 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Physical signals are not likely to be independent across time
◮ Straight forward interpretation of the confidence level ◮ And sometimes reduction the measurement period ◮ Loose intuition about the POIs
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 20 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Physical signals are not likely to be independent across time
◮ Straight forward interpretation of the confidence level ◮ And sometimes reduction the measurement period ◮ Loose intuition about the POIs
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 20 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Physical signals are not likely to be independent across time
◮ Straight forward interpretation of the confidence level ◮ And sometimes reduction the measurement period ◮ Loose intuition about the POIs
◮ TVLA: too conservative ◮ D-test: too optimistic
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 20 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Physical signals are not likely to be independent across time
◮ Straight forward interpretation of the confidence level ◮ And sometimes reduction the measurement period ◮ Loose intuition about the POIs
◮ TVLA: too conservative ◮ D-test: too optimistic
Evaluation Hardness
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 20 / 20
Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion
Physical signals are not likely to be independent across time
◮ Straight forward interpretation of the confidence level ◮ And sometimes reduction the measurement period ◮ Loose intuition about the POIs
◮ TVLA: too conservative ◮ D-test: too optimistic
Evaluation Hardness
github.com/obronchain/multituple_leakage_detection
Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 20 / 20