A Novel Use of Kernel Discriminant Analysis as a Higher-Order Side-Channel Distinguisher

Distinguishers play an important role in Side Channel Analysis (SCA), where real world leakage information is compared against hypothetical predictions in order to guess at the underlying secret key. However, the direct relationship between leakages and predictions can be disrupted by the mathematical combining of dd random values with each sensitive intermediate value of the cryptographic algorithm (a so-called ``dd-th order masking scheme''). In the case of software implementations, as long as the masking has been correctly applied, the guessable intermediates will be independent of any one point in the trace, or indeed of any tuple of fewer than d+1d+1 points. However, certain d+1d+1-tuples of time points may jointly depend on the guessable intermediates. A typical approach to exploiting this data dependency is to pre-process the trace -- computing carefully chosen univariate functions of all possible d+1d+1-tuples -- before applying the usual univariate distinguishers. This has a computational complexity which is exponential in the order dd of the masking scheme. In this paper, we propose a new distinguisher based on Kernel Discriminant Analysis (KDA) which directly exploits properties of the mask implementation without the need to exhaustively pre-process the traces, thereby distinguishing the correct key with lower complexity.