对一种纵向重用型 AES 掩码的能量分析攻击

This paper aims to explain that mask reused vertically in a same round of cryptographic algorithm is insecure. For three leakage positions of a masking scheme proposed by Oswald et al., two attacks, second-order correlation power analysis and collision attack, are presented. Based on AT89S52 singlechip, practical power analysis attacks are mounted. According to our experiments, 30000 power traces are needed for recovering the 128-bit key in second-order CPA. Collision attack costs 10000 traces, but it needs some subsequent searches. Finally, we suggest that mask can be reused among different rounds, but horizontal or vertical usage in a same round should be avoided.