Transparency Order of (n, m)-Functions—Its Further Characterization and Applications

Abstract

The concept of transparency order is a useful measure for the robustness of (n, m)-functions (cryptographic S-boxes as mappings from $GF(2)^n$ to $GF(2)^m$) to multi-bit Differential Power Analysis (DPA). The recently redefined notion of transparency order ($\mathcal {RTO}$), based on the cross-correlation coefficients, uses a very delicate assumption that the adversary has a priori knowledge about the so called pre-charged logic value (a constant register value set by a system) used in DPA-like attacks. Moreover, quite contradictorily, this constant value is used as a variable when maximizing $\mathcal {RTO}$. To make the attack scenario more realistic, the notion of differential transparency order ($\mathcal {DTO}$) is defined for (n, m)-functions, which can efficiently eliminate the impact posed by this pre-charged logic value. By considering (4, 4) S-boxes which are commonly used in the design of lightweight block ciphers, we deduce in the simulated scenario that the information leakage using $\mathcal {DTO}$ is usually larger compared to the standard indicator. Towards its practical applications, we illustrate that the correlation power analysis (CPA) based on the novel notion of $\mathcal {DTO}$ performs better than that uses the classical notion of $\mathcal {RTO}$. This conclusion is confirmed in two cases, i.e. CPA against MARVIN and CPA against PRESENT-128.