Clustering versus Statistical Analysis for SCA: when Machine Learning is Better

TL;DR

This paper compares statistical and machine learning methods for side-channel analysis of elliptic curve cryptography, finding that K-means clustering is more effective with unbalanced scalars than simple mean comparison.

Contribution

The study demonstrates the advantages of K-means clustering over simple statistical analysis in analyzing power traces for cryptographic side-channel attacks, especially with unbalanced scalars.

Findings

K-means is effective with highly unbalanced scalars.

Comparison to the mean works only with balanced scalars.

Machine learning can improve SCA analysis in certain scenarios.

Abstract

Evaluation of the resistance of implemented cryptographic algorithms against SCA attacks, as well as detecting of SCA leakage sources at an early stage of the design process, is important for an efficient re-design of the implementation. Thus, effective SCA methods that do not depend on the key processed in the cryptographic operations are beneficially and can be a part of the efficient design methodology for implementing cryptographic approaches. In this work we compare two different methods that are used to analyse power traces of elliptic curve point multiplications. The first method the comparison to the mean is a simple method based on statistical analysis. The second one is K-means - the mostly used unsupervised machine learning algorithm for data clustering. The results of our early work showed that the machine learning algorithm was not superior to the simple approach. In this work we concentrate on the comparison of the attack results using both analysis methods with the goal to understand their benefits and drawbacks. Our results show that the comparison to the mean works properly only if the scalar processed during the attacked kP execution is balanced, i.e. if the number of '1' in the scalar k is about as high as the number of '0'. In contrast to this, K-means is effective also if the scalar is highly unbalanced. It is still effective even if the scalar k contains only a very small number of '0' bits.