J. Cryptol. (2011) 24: 269–291 DOI: 10.1007/s00145-010-9084-8 Mutual Information Analysis: a Comprehensive Study∗ Lejla Batina ESAT/SCD-COSIC and IBBT, K.U.Leuven, Kasteelpark Arenberg 10, 3001 Leuven-Heverlee, Belgium
[email protected] and CS Dept./Digital Security group, Radboud University Nijmegen, Heyendaalseweg 135, 6525 AJ, Nijmegen, The Netherlands Benedikt Gierlichs ESAT/SCD-COSIC and IBBT, K.U.Leuven, Kasteelpark Arenberg 10, 3001 Leuven-Heverlee, Belgium
[email protected] Emmanuel Prouff Oberthur Technologies, 71-73 rue des Hautes Pâtures, 92726 Nanterre Cedex, France
[email protected] Matthieu Rivain CryptoExperts, Paris, France
[email protected] François-Xavier Standaert† and Nicolas Veyrat-Charvillon UCL Crypto Group, Université catholique de Louvain, 1348 Louvain-la-Neuve, Belgium
[email protected];
[email protected] Received 1 September 2009 Online publication 21 October 2010 Abstract. Mutual Information Analysis is a generic side-channel distinguisher that has been introduced at CHES 2008. It aims to allow successful attacks requiring min- imum assumptions and knowledge of the target device by the adversary. In this paper, we compile recent contributions and applications of MIA in a comprehensive study. From a theoretical point of view, we carefully discuss its statistical properties and re- lationship with probability density estimation tools. From a practical point of view, we apply MIA in two of the most investigated contexts for side-channel attacks. Namely, we consider first-order attacks against an unprotected implementation of the DES in a full custom IC and second-order attacks against a masked implementation of the DES in an 8-bit microcontroller.