Non-Invasive Attacks Testing: Feedback on Relevant Methods

Testable security is a key concept in FIPS 140 standards. The application of this method to non-invasive attacks is a hot topic, both for FIPS 140-3 and forthcoming ISO 17825. This paper provides insights on relevant methodologies, based on realworld case studies. Our main point is that testing divides into two tasks, namely “leakage detection” and “leakage analysis”. The first task is by far the less covered in the public literature. It involves techniques like sensor selection, device under test cartography, time-frequency signal analysis, and variance tests. It must be fast (and is ideally online) as the detection shall be tested on various time samples and X−Y (Z− θ) positions. The second task is more mature, and basically already drafted in ISO 17825. Obviously, basic distinguishers, aimed to detect simple albeit generic leakages with a low computational overhead are preferred.