Success Rate (SR) is one of the most popular side-channel security metrics measuring the efficiency of key recovery. Theoretical expression of success rate reveals the functional dependency between relevant parameters such as number of measurements and Signal-to-Noise Ratio (SNR), helping researchers understand the resistance of a given implementation rapidly. However so far, existing works have exposed fundamental problems: (1) Evaluation is confined to a very limited range of distinguishers and specialized methods; (2) Evaluation assumes a perfect leakage model that is detached from reality. It is widely observed that an inaccurate leakage model will lead to a degraded or even distorted success rate. In this paper, we tackle above problems by introducing a novel framework which is able to evaluate seven side-channel distinguishers with a unified expression. Among them, we explore four new distinguishers that have not been investigated in the existing literature. Within the framework, DPA distinguishers are intuitively understood as linear maximum likelihood attack testing closeness between vectors with some easy-to-comprehend geometric metrics. Our evaluation is able to deal with profiled models of any quality and is agnostic to model profiling techniques. It uniquely enables the evaluation of success rates under inaccurate leakage models, whilst providing an (indirect) answer to the open question “how much information is lost due to the model biases” through quantifying the degradation of success rates. Finally, we formulate a set of criterion values for quantitative analyses of the model biases. It provides theoretical evidences for a more thorough explanation for the various behaviors of DPA attacks. Experimental results are inline with the theory, confirming its practical applicability.

中文翻译：

---

现在什么是可能的？不准确泄漏模型的单变量 DPA 攻击的安全评估


成功率 (SR) 是衡量密钥恢复效率的最流行的侧通道安全指标之一。成功率的理论表达揭示了测量次数和信噪比（SNR）等相关参数之间的函数依赖性，帮助研究人员快速了解给定实施的阻力。然而，到目前为止，现有的工作暴露了根本性问题：（1）评估仅限于非常有限的区分器和专门方法； (2) 评估假设了一个脱离实际的完美泄漏模型。人们普遍认为，不准确的泄漏模型会导致成​​功率下降甚至扭曲。在本文中，我们通过引入一种新颖的框架来解决上述问题，该框架能够用统一的表达式评估七个侧通道区分器。其中，我们探索了现有文献中尚未研究的四个新的区分因素。在该框架内，DPA 区分器被直观地理解为线性最大似然攻击，通过一些易于理解的几何度量来测试向量之间的接近度。我们的评估能够处理任何质量的分析模型，并且与模型分析技术无关。它独特地能够评估不准确泄漏模型下的成功率，同时通过量化成功率的下降，为“由于模型偏差而丢失了多少信息”这一开放性问题提供（间接）答案。最后，我们制定了一组用于模型偏差定量分析的标准值。它为更彻底地解释DPA攻击的各种行为提供了理论证据。 实验结果与理论相符，证实了其实际应用性。