path: root/DPA.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Differential Power Analysis"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "This notebook demonstrates the functionality of the `DPA` class, which implements Differential Power Analysis side-channel attack. The attack is first performed and evaluated on leakage traces simulated by the `LeakageTarget` class and subsequently on leakage traces simulated by the `EmulatorTarget` class."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Initialisation"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "from pyecsca.ec.mult import LTRMultiplier\n",
    "from pyecsca.ec.mod import mod\n",
    "from pyecsca.ec.point import Point, InfinityPoint\n",
    "from pyecsca.ec.model import ShortWeierstrassModel\n",
    "from pyecsca.ec.curve import EllipticCurve\n",
    "from pyecsca.ec.params import DomainParameters\n",
    "from pyecsca.sca.attack.DPA import DPA\n",
    "from pyecsca.sca.attack.CPA import CPA\n",
    "from pyecsca.sca.attack.leakage_model import HammingWeight\n",
    "from pyecsca.sca.target.leakage import LeakageTarget\n",
    "from pyecsca.sca.trace import Trace\n",
    "from pyecsca.sca.trace.edit import stretch\n",
    "from pyecsca.sca.trace.process import rolling_mean\n",
    "from pyecsca.codegen.client import EmulatorTarget\n",
    "from rainbow import TraceConfig\n",
    "from rainbow.leakage_models import HammingWeight\n",
    "from random import randint\n",
    "import holoviews as hv\n",
    "import multiprocessing as mp\n",
    "import numpy as np\n",
    "import matplotlib.pyplot as plt\n",
    "import pickle"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "hv.extension(\"bokeh\")\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We first define the elliptic curve parameters we are going to be using for the demonstration."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "model = ShortWeierstrassModel()\n",
    "coords = model.coordinates[\"projective\"]\n",
    "p = 0xd7d1247f\n",
    "a = mod(0xa4a44016, p)\n",
    "b = mod(0x73f76716, p)\n",
    "n = 0xd7d2a475\n",
    "h = 1\n",
    "gx, gy, gz = mod(0x54eed6d7, p), mod(0x6f1e55ac, p), mod(1, p)\n",
    "generator = Point(coords, X=gx, Y=gy, Z=gz)\n",
    "neutral = InfinityPoint(coords)\n",
    "\n",
    "curve = EllipticCurve(model, coords, p, neutral, {\"a\": a, \"b\": b})\n",
    "params = DomainParameters(curve, generator, n, h)\n",
    "\n",
    "add = coords.formulas[\"add-1998-cmo\"]\n",
    "dbl = coords.formulas[\"dbl-1998-cmo\"]\n",
    "scl = coords.formulas[\"z\"]\n",
    "\n",
    "mult = LTRMultiplier(add, dbl, None)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We create and initialize an instance of the `LeakageTarget` class with the above elliptic curve parameters."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "target = LeakageTarget(model, coords, mult, HammingWeight())\n",
    "target.set_params(params)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Using the attack, we will try to recover an 8-bit scalar used in the scalar multiplication operation."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "scalar_bit_length = 8\n",
    "secret_scalar = 229"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We will perform scalar multiplication on 10 000 random points on the curve and simulate 10 000 corresponding leakage traces, which we will then use to evaluate the attack. "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "num_of_traces = 2000"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "generated_points, generated_traces = target.simulate_scalar_mult_traces(num_of_traces, secret_scalar)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Performing the attack"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We create and initialize an instance of the `DPA` class containing the attack's implementation."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "mult.init(params, params.generator)\n",
    "real_pub_key = mult.multiply(secret_scalar)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "dpa = DPA(generated_points, generated_traces, mult, params)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We perform the attack and test that the scalar we recovered is correct."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "recovered_scalar = dpa.perform(scalar_bit_length, real_pub_key)\n",
    "print(recovered_scalar)\n",
    "print(recovered_scalar == secret_scalar)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We can visualize the differences of means calculated during the attack. Below are shown DOMs for correct and incorrect guess of the second bit of the scalar, followed by DOMs of correct guesses for fourth and sixth bit of the scalar to show the location of peeks."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Correct difference of means when guessing 2. bit (guessed scalar 192 = 1100 0000)\n",
    "dpa.plot_difference_of_means(dpa.doms['guess_one'][0])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Incorrect difference of means when guessing 2. bit (guessed scalar 128 = 1000 0000)\n",
    "dpa.plot_difference_of_means(dpa.doms['guess_zero'][0])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Correct difference of means when guessing 4. bit (guessed scalar 224 = 1110 0000)\n",
    "dpa.plot_difference_of_means(dpa.doms['guess_zero'][2])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Correct difference of means when guessing 6. bit (guessed scalar 229 = 1110 0100)\n",
    "dpa.plot_difference_of_means(dpa.doms['guess_one'][-2])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Evaluating the effectiveness of the attack"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We will evaluate how the success rate of the attack increases with an increasing number of traces and subsequently evaluate how the success rate for a fixed number of traces changes with increasing noise. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "To have a convenient way of generating random subsets, we define the following function:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "def select_random_sample(size, points, traces):\n",
    "    sample_points = []\n",
    "    sample_traces = []\n",
    "    selected_numbers = []\n",
    "    for _ in range(size):\n",
    "        num = randint(0, num_of_traces - 1)\n",
    "        if num not in selected_numbers:\n",
    "            selected_numbers.append(num)\n",
    "        sample_points.append(points[num])\n",
    "        sample_traces.append(traces[num])\n",
    "    return sample_points, sample_traces"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Success rate with changing number of traces"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We take subsets of different sizes and plot the success rate of the DPA corresponding to them. For each size, we perform the DPA 100 times on 100 generated subsets."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "def DPA_traces(points, traces, sample_size, scalar_length, pub_key, multiplier, domain_params):\n",
    "    sample_points, sample_traces = select_random_sample(sample_size, points, traces)\n",
    "    sample_dpa = DPA(sample_points, sample_traces, multiplier, domain_params)\n",
    "    recovered = sample_dpa.perform(scalar_length, pub_key)\n",
    "    return recovered == secret_scalar\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "number_of_subsets = 17\n",
    "successes_rates_traces = []\n",
    "number_of_samples = [x * 100 for x in range(1, number_of_subsets)]\n",
    "for num in number_of_samples:\n",
    "    with mp.Pool() as pool:\n",
    "        result_objects = [pool.apply_async(DPA_traces, args=(generated_points, generated_traces, num, scalar_bit_length, \n",
    "                                                             real_pub_key, mult, params)) for _ in range(100)]\n",
    "        results = [result.get() for result in result_objects]\n",
    "    successes_rates_traces.append(sum(results) / 100)\n",
    "    print(f\"done for {num}\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We plot the results."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "plt.plot(number_of_samples, successes_rates_traces, color='black')\n",
    "plt.ylim([0, 1])\n",
    "plt.xlabel('number of traces')\n",
    "plt.ylabel('DPA success rate')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Success rate with fixed number of traces and changing noise"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "As we now know the the minimum amount of traces needed for 100% success rate, we generate 100 subsets with that amount of traces and perform DPA for each subset. We do this multiple times with different amount of noise."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "def normalize_trace(trace: Trace):\n",
    "    min_val = np.min(trace.samples)\n",
    "    max_val = np.max(trace.samples)\n",
    "    scaled_samples = (trace.samples - min_val) / (max_val - min_val) \n",
    "    trace.samples = scaled_samples   \n",
    "\n",
    "def DPA_noise(points, traces, sample_size, standard_deviation, scalar_length, pub_key, multiplier, domain_params):\n",
    "    sample_points, sample_traces = select_random_sample(sample_size, points, traces)\n",
    "    for trace in sample_traces:\n",
    "        normalize_trace(trace)\n",
    "    noise = np.random.normal(0, standard_deviation, sample_traces[0].samples.shape)\n",
    "    for trace in sample_traces:\n",
    "        trace.samples = trace.samples + noise\n",
    "    sample_dpa = DPA(sample_points, sample_traces, multiplier, domain_params)\n",
    "    recovered = sample_dpa.perform(scalar_length, pub_key)\n",
    "    return recovered == secret_scalar\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "number_of_subsets = 17\n",
    "successes_rates_noise = []\n",
    "sample_size = 1600\n",
    "noise_sds = [0.05 * x for x in range(number_of_subsets)] \n",
    "for sd in noise_sds:\n",
    "    with mp.Pool() as pool:\n",
    "        result_objects = [pool.apply_async(DPA_noise, args=(generated_points, generated_traces, sample_size, sd, scalar_bit_length, \n",
    "                                                             real_pub_key, mult, params)) for _ in range(100)]\n",
    "        results = [result.get() for result in result_objects]\n",
    "    successes_rates_noise.append(sum(results) / 100)\n",
    "    print(f\"done for {sd}\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We plot the results."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "plt.plot(noise_sds, successes_rates_noise, color='black')\n",
    "plt.ylim([0, 1])\n",
    "plt.xlabel('Gaussian noise (standard deviation)')\n",
    "plt.ylabel('DPA success rate')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## DPA on leakage traces simulated by `EmulatorTarget`."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We gather leakage traces simulated by the `EmulatorTarget`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "with open('/data/xbatora/traces_8bit.pickle', 'rb') as f:\n",
    "    traces_emulator = pickle.load(f)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "points_emulator = []\n",
    "max_length = 0\n",
    "for trace in traces_emulator:\n",
    "    if(len(trace) > max_length):\n",
    "        max_length = len(trace)\n",
    "    points_emulator.append(Point(coords, **trace.meta['coords']))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The traces are not equally long. We `stretch` them to the same length. This should also reduce misalignment."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "stretched_traces = []\n",
    "for trace in traces_emulator:\n",
    "    stretched_traces.append(stretch(trace, max_length))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We recover the second bit of the scalar. We know it should equal one, so we plot its corresponding DOM that should show a peak."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "recovered_scalar = 128 #1000 0000"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "dpa_emulator = DPA(points_emulator, stretched_traces, mult, params)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "recovered_scalar = 128 #1000 0000\n",
    "res = dpa_emulator.recover_bit(recovered_scalar, 1, scalar_bit_length, real_pub_key)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The peak is not visible"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "dpa_emulator.plot_difference_of_means(dpa_emulator.doms['guess_one'][0])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The peak is not visible due to a significant misalignment. We apply rolling mean to the traces, which should reduce the misalignment. We perform the DPA again."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "rolling_mean_traces = []\n",
    "for trace in stretched_traces:\n",
    "    rolling_mean_traces.append(rolling_mean(trace, 3000))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "dpa_emulator = DPA(points_emulator, rolling_mean_traces, mult, params)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "recovered_scalar = 128 #1000 0000\n",
    "res = dpa_emulator.recover_bit(recovered_scalar, 1, scalar_bit_length, real_pub_key)\n",
    "print(res)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "dpa_emulator.plot_difference_of_means(dpa_emulator.doms['guess_one'][0])"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.11.8"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}