JP2012080344A - Side channel attack resistance evaluating device, and side channel attack resistance evaluating method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve resistance evaluation accuracy by separating a signal source related to confidential information from the other signal sources which become noise.SOLUTION: A side channel information measuring portion 2 measures side channel information which leaks from an encryption device 1 of an evaluation target. A passing band deciding portion 4 decides a passing band of a quefrency window. A cepstrum analyzing portion 3 executes cepstrum analysis on tha basis of the passing band of the quefrency window, to the side channel information measured by the side channel information measuring portion 2. A DSCA resistance evaluating portion 5 determines the pros and cons of resistance to a side channel attack of the encryption device 1 of the evaluation target, on the basis of the side channel information analyzed by the cepstrum analyzing portion 3.

Description

  The present invention relates to a side channel attack resistance evaluation apparatus, a side channel attack resistance evaluation method, and a program for performing resistance evaluation against a side channel attack, and more particularly to resistance to a side channel attack using side channel information leaked from a cryptographic apparatus. The present invention relates to a side channel attack resistance evaluation apparatus, a side channel attack resistance evaluation method, and a program for performing evaluation.

  As information is converted into electronic data, encryption is an indispensable technology for information protection and confidential communication. In order to maintain the security of the cipher, it is necessary to prevent secret information such as a key from being easily guessed. Cryptanalysis methods such as full key search, mathematical cryptanalysis, differential cryptanalysis, and the like are known, but it can be said that analysis in real time is impossible.

  On the other hand, side channel information under the assumption that attackers can accurately measure side channel information such as processing time and power consumption in devices such as IC cards with a cryptographic function and portable terminals. A side-channel attack that attempts to acquire confidential information from the Internet and its countermeasures are major research themes. The side channel information includes information related to the processing and data being executed in the cryptographic device that is the target of attack. By analyzing the side channel information, the cryptographic algorithm, processing timing, and secret key can be estimated. It is. Among these side channel attacks, as a particularly powerful attack method, differential side channel analysis (hereinafter referred to as DSCA) that estimates secret information while suppressing the influence of noise or the like by statistical processing on a plurality of side channel information. Called). DSCA has several methods depending on the type of side channel information used for an attack. When power consumption is used, differential power analysis (hereinafter referred to as DPA) (see, for example, Non-Patent Document 1), In the case of using electromagnetic waves, there is what is called differential electro-magnetic analysis (hereinafter referred to as DEMA) (for example, see Non-Patent Document 2).

  In an apparatus in which encryption is implemented, attack resistance (tamper resistance) against side channel attacks is required in practice. For this reason, research on tamper resistance technology that makes it difficult to estimate secret information such as encryption algorithms from side channel information has been promoted. Here, tamper resistance refers to the performance of preventing leakage of confidential information and modification of functions against attacks. As a tamper resistant technique, a tamper resistant technique (see, for example, Patent Document 1) that prevents leakage of confidential information from side channel information by arbitrarily adding unnecessary information to side channel information has been proposed. Here, it is necessary to evaluate the effectiveness of the tamper-resistant technique as to whether the resistance to side channel attacks is actually improved by applying the tamper-resistant technique as described above.

  In addition, in order to confirm whether or not the installed cryptographic device is really safe, a technique for evaluating the resistance to side channel attacks is required (for example, see Non-Patent Document 3).

  However, when evaluating side channel attack resistance, unnecessary information such as measurement noise and environmental noise is added to the side channel information, or the measurement waveform shifts due to measurement timing shifts. In some cases, the feature indicating the confidential information to be extracted cannot be extracted from the side channel information. Therefore, in order to accurately evaluate the resistance to side channel attacks, measures such as removal of unnecessary information included in the side channel information and correction of deviation are required.

  As a technique for reducing the influence of the positional deviation, there is a frequency difference analysis (hereinafter referred to as DFA) (for example, see Non-Patent Document 4).

  The DFA obtains the intensity (power spectrum) for each frequency component by converting the side channel information measured in the time domain into the frequency domain by discrete Fourier transform (hereinafter referred to as DFT). This is a technique for performing DSCA on the power spectrum, and is effective for time lag during measurement.

JP 2007-116215 A

P. Kocher, J. Jaffe, and B. Jun, "Introduction to Differential Power Analysis and Related Attacks,", 1998. K. Gandolfi, C. Mourtel, and F. Olivier, "Electromagnetic Analysis: Concrete Results," CHES 2001, LNCS 2162, pp.251-262, 2001. Hideki Imai "Information Security-For a Safe and Secure Society", IEICE Journal, 2007, Vol.90, No.5, pp.334-339 C. Gebotys, A. Tiu, "EM Analysis of Rijndael and ECC on a Wireless Java-based PDA," CHES 2005, LNCS 3659, pp. 250-625, 2005.

  In the tamper resistance evaluation for the DSCA of the encryption device, it is desirable to perform the evaluation on the side channel information that is not affected by the positional deviation at the time of measurement or other signal sources.

  However, although the DFA shown above has an effect on the positional deviation at the time of measurement, it is not taken into consideration when a plurality of signal sources are convoluted.

  The objective of this invention is providing the side channel attack tolerance evaluation apparatus, the side channel attack tolerance evaluation method, and program which solve the subject mentioned above.

The side channel attack resistance evaluation device of the present invention is
A side channel attack resistance evaluation device that analyzes internal processing of encryption and confidential information using side channel information leaked from an encryption device,
A side channel information measurement unit that measures side channel information leaked from the cryptographic device to be evaluated;
A passband determining unit for determining the passband of the kerflen window,
For the side channel information measured by the side channel information measurement unit, a cepstrum analysis unit that performs cepstrum analysis based on the passband of the quefrency window;
A differential side channel attack resistance evaluation unit that determines whether the evaluation target encryption device is resistant to a side channel attack based on the side channel information analyzed by the cepstrum analysis unit.

Also, the side channel attack resistance evaluation method of the present invention is:
A side channel attack resistance evaluation method for analyzing encryption internal processing and confidential information using side channel information leaked from a cryptographic device,
Processing to measure side channel information leaked from the cryptographic device to be evaluated;
A process for determining the passband of the kerflen window,
A process of performing cepstrum analysis on the measured side channel information based on the passband of the kerflens window;
Based on the analyzed side channel information, a process of determining whether or not the cryptographic device to be evaluated is resistant to a side channel attack is performed.

The program of the present invention is
A program for causing a side channel attack resistance evaluation device to analyze internal processing of encryption and confidential information using side channel information leaked from an encryption device,
Procedure for measuring side channel information leaked from the cryptographic device to be evaluated;
A procedure for determining the passband of the kerf window;
A procedure for performing cepstrum analysis on the measured side channel information based on the passband of the quefrency window;
Based on the analyzed side channel information, a procedure for determining whether or not the cryptographic device to be evaluated is resistant to a side channel attack is executed.

  As described above, in the present invention, by performing a cepstrum analysis on the measured side channel information, it is possible to separate a signal source related to secret information from a signal source that causes other noise, and tolerate it. Evaluation accuracy can be improved.

It is a figure which shows an example of schematic structure of the side channel attack tolerance evaluation apparatus which concerns on embodiment which can apply this invention. It is a flowchart for demonstrating the 1st difference side channel attack tolerance evaluation method in the form shown in FIG. It is a flowchart for demonstrating the 2nd difference side channel attack tolerance evaluation method in the form shown in FIG. It is a flowchart for demonstrating an example of the 3rd difference side channel attack tolerance evaluation method in the form shown in FIG. It is a flowchart for demonstrating the other example of the 3rd difference side channel attack tolerance evaluation method in the form shown in FIG. It is a flowchart for demonstrating the 4th difference side channel attack tolerance evaluation method in the form shown in FIG. It is a figure which shows the waveform of the leakage electromagnetic wave measured in the side channel information measurement part shown in FIG. It is a figure which shows the waveform which implemented the cepstrum conversion process with respect to the electromagnetic wave waveform shown in FIG. It is a figure which shows a difference waveform when correct secret information is guessed as a result of implementing DSCA with respect to the waveform shown in FIG. FIG. 9 is a diagram showing a spectrum sequence obtained by performing filtering, DFT, and exponent calculation on the cepstrum shown in FIG. 8 in the determined passband of the quefrency window.

  EMBODIMENT OF THE INVENTION Below, the form for implementing this invention is demonstrated in detail with reference to drawings.

  FIG. 1 is a diagram illustrating an example of a schematic configuration of a side channel attack resistance evaluation apparatus according to an embodiment to which the present invention is applicable.

  Referring to FIG. 1, the side channel attack resistance evaluation device 6 includes a side channel information measurement unit 2 that measures side channel information of the encryption device 1 to be evaluated, and side channel information measured by the side channel information measurement unit 2. A cepstrum analysis unit 3 that performs cepstrum analysis, a passband determination unit 4 that determines an optimal passband of the quefrency window in the cepstrum analysis performed by the cepstrum analysis unit 3, and a differential side channel attack that evaluates resistance to DSCA A DSCA resistance evaluation unit 5 which is a resistance evaluation unit is provided.

  The encryption device 1 is a device that performs encryption / decryption processing such as encryption on plaintext and decryption on ciphertext. The encryption device 1 can employ various information processing devices that execute encryption / decryption processing. For example, the encryption device 1 may be a personal computer (PC), a portable terminal, an IC card, or the like.

  The side channel information measuring unit 2 measures side channel information leaked when the encryption device 1 performs encryption / decryption processing. As the side channel information, various kinds of information affected by internal processing in the encryption device 1 can be adopted. For example, power, electromagnetic waves, sound, temperature, etc. may be used. Here, for example, when electromagnetic waves are used as the side channel information, the side channel information measurement unit 2 may be a measurement device such as an oscilloscope or a spectrum analyzer.

  The cepstrum analysis unit 3 obtains a cepstrum sequence using DFT, Inverse-DFT (hereinafter referred to as IDFT) and logarithmic transformation based on the side channel information measured by the side channel information measurement unit 2. Then, the cepstrum analysis unit 3 performs a filtering process on the quefrency sequence using the quefrency window. Further, the cepstrum analysis unit 3 converts the result of the filtering process into a logarithmic amplitude spectrum series by using DFT. Further, the cepstrum analysis unit 3 obtains a spectrum sequence that has been subjected to cepstrum analysis by exponentially calculating the conversion result to the logarithmic amplitude spectrum sequence.

  In general, there are various cepstrum calculation methods. The cepstrum analysis unit 3 obtains a quefrency sequence or a cepstrum-analyzed spectrum sequence using any one of them.

  Depending on the embodiment, the cepstrum analysis unit 3 outputs a cepstrum sequence or a spectrum sequence after cepstrum analysis to the DSCA tolerance evaluation unit 5. Note that the passband of the kerflen window is determined by the passband determination unit 4. By converting to a cepstrum sequence, the convolved signal appears in different quefrency regions. When DSCA is performed with a cepstrum sequence, a peak appears in a quefrency band related to DSCA, and secret information can be obtained. Further, the convolution signal can be separated by multiplying the cepstrum sequence by a quefrency window. Therefore, by extracting only the components related to DSCA, the influence of the convolved components can be reduced, and the accuracy of DSCA is improved.

  The passband determining unit 4 is a means for determining the passband of the kerflenency window used in the cepstrum analyzing unit 3. As a determination method, a method of inputting by a user of the apparatus, a method of quoting from information registered in the database, a method of determining from side channel information once measured by the side channel information measuring unit 2, an evaluation by the DSCA tolerance evaluating unit 5 A method of determining according to the result can be considered.

  The DSCA tolerance evaluation unit 5 performs DSCA on the side channel information processed by the cepstrum analysis unit 3 and evaluates whether or not the secret information can be derived and the amount of side channel information necessary to derive the secret information.

The side channel attack resistance evaluation device 6 having such a configuration analyzes the internal processing of encryption and confidential information using the side channel information leaked from the encryption device 1.
(First evaluation method)
Next, the first differential side channel attack resistance evaluation method in this embodiment will be described.

  FIG. 2 is a flowchart for explaining the first differential side channel attack resistance evaluation method in the embodiment shown in FIG.

  First, the side channel information measuring unit 2 measures the side channel information leaked from the evaluation target encryption device 1 (step S1).

  Next, the passband determining unit 4 determines the passband of the kerfrenunciation window (step S2).

  Subsequently, the cepstrum analysis unit 3 converts the side channel information measured by the side channel information measurement unit 2 into a quefrency sequence, filtering based on the passband of the quefrency window determined by the passband determination unit 4, and spectrum. Cepstrum analysis such as sequence calculation is performed, and cepstrum analyzed side channel information is output (step S3).

  Finally, using the side channel information output from the cepstrum analysis unit 3, the DSCA tolerance evaluation unit 5 performs DSCA tolerance evaluation of an evaluation target (step S4).

As described above, the cepstrum analysis is performed and the signal source related to the secret information is separated from the signal source that causes other noise, thereby improving the tolerance evaluation accuracy.
(Second evaluation method)
Next, the second differential side channel attack resistance evaluation method in this embodiment will be described.

  FIG. 3 is a flowchart for explaining the second differential side channel attack resistance evaluation method in the embodiment shown in FIG.

  First, the side channel information leaking from the cryptographic device 1 to be evaluated is measured by the side channel information measuring unit 2 (step S11).

  Next, the cepstrum analysis unit 3 converts the side channel information measured by the side channel information measurement unit 2 into a quefrency sequence (cepstrum conversion), and outputs a cepstrum of the side channel information (step S12).

  Finally, using the cepstrum of the side channel information output from the cepstrum analysis unit 3, the DSCA tolerance evaluation unit 5 performs DSCA tolerance evaluation of an evaluation target (step S13).

Thus, by converting the side channel information into the quefrency sequence, the signal source related to the secret information and the signal source that becomes other noise are separated on the quefrency, thereby improving the tolerance evaluation accuracy.
(Third evaluation method)
Next, the third differential side channel attack resistance evaluation method in this embodiment will be described.

  FIG. 4 is a flowchart for explaining an example of the third differential side channel attack resistance evaluation method in the embodiment shown in FIG.

  First, the side channel information leaking from the encryption device 1 to be evaluated is measured by the side channel information measuring unit 2 (step S21).

  Next, the passband determination unit 4 determines the passband of the kerfrenity window according to the side channel information measured by the side channel information measurement unit 2 (step S22).

  Subsequently, the cepstrum analysis unit 3 converts the side channel information measured by the side channel information measurement unit 2 into a quefrency sequence, filtering based on the passband of the quefrency window determined by the passband determination unit 4, and spectrum. Cepstrum analysis such as series calculation is performed, and side channel information that has been subjected to cepstrum analysis is output (step S23).

  Finally, using the side channel information output from the cepstrum analysis unit 3, the DSCA resistance evaluation unit 5 performs DSCA resistance evaluation to be evaluated (step S24).

  The difference from the first evaluation method is that the side channel information measured by the side channel information measurement unit 2 is used for the determination of the passband of the kerfrenunciation window in the passband determination unit 4.

  Thus, by determining the passband of the kerfrency window from the side channel information, it is possible to determine the passband of the kerfrency window suitable for DSCA, and as a result, the tolerance evaluation accuracy is improved.

  As a method for determining the passband of the kerfrenunciation window using the side channel information, a method of converting to a quefrency sequence once and determining with reference to the peak position appearing in the kerfrenency sequence is conceivable.

  FIG. 5 is a flowchart for explaining another example of the third differential side channel attack resistance evaluation method in the embodiment shown in FIG.

  First, the side channel information measuring unit 2 measures the side channel information leaked from the encryption device 1 to be evaluated (step S31).

  Next, the passband determination unit 4 converts the side channel information measured by the side channel information measurement unit 2 into a quefrency sequence (step S32), and the passband of the kerfrenciency window with reference to the peak position of the quefrency sequence Is determined (step S33).

  As a band when the peak position of the quefrency sequence is used as a reference, only the vicinity of the peak is allowed to pass, only the quefrency band below the peak is allowed to pass, and only the kerfrenciency band above the peak is allowed to pass.

  Subsequently, the cepstrum analysis unit 3 performs cepstrum analysis such as filtering based on the passband of the quefrency window determined by the passband determination unit 4 and calculation of a spectrum sequence, and outputs the side channel information after the cepstrum analysis (step) S34).

Finally, using the side channel information output from the cepstrum analysis unit 3, the DSCA resistance evaluation unit 5 performs DSCA resistance evaluation to be evaluated (step S35).
(Fourth evaluation method)
Next, a fourth differential side channel attack resistance evaluation method in this embodiment will be described.

  FIG. 6 is a flowchart for explaining a fourth differential side channel attack resistance evaluation method in the embodiment shown in FIG.

  First, the side channel information measuring unit 2 measures the side channel information leaked from the evaluation target encryption device 1 (step S41).

  Next, the cepstrum analysis unit 3 converts the side channel information measured by the side channel information measurement unit 2 into a quefrency sequence, and outputs a cepstrum of the side channel information (step S42).

  Then, using the cepstrum of the side channel information output from the cepstrum analysis unit 3, the DSCA tolerance evaluation unit 5 performs DSCA tolerance evaluation of an evaluation target (step S43).

  Subsequently, the evaluation result is output to the passband determination unit 4, and the passband determination unit 4 determines the passband of the kerfrenunciation window according to the evaluation result (step S 44). More specifically, the pass band of the kerfrenunciation window is determined with reference to the kerfrenzy component obtained from the result.

  Subsequently, the cepstrum analysis unit 3 converts the side channel information measured by the side channel information measurement unit 2 into a quefrency sequence and is based on the passband of the kerfrenity window determined by the passband determination unit 4 in step S44. Cepstrum analysis such as filtering and spectrum series calculation is performed, and side channel information that has been subjected to cepstrum analysis is output (step S45).

  Finally, using the side channel information output from the cepstrum analysis unit 3, the DSCA resistance evaluation unit 5 performs DSCA resistance evaluation to be evaluated (step S46).

  The difference from the first evaluation method is that DSCA is performed once using a cepstrum, and the passband of the kerfrenciency window in the passband determination unit 4 is determined based on the result.

  In DSCA using a cepstrum, when correct secret information is estimated, a high peak (intensity) is generated in a specific quefrency component. The quefrency component in which the peak is generated is used as a reference to determine the passband of the quefrency window in the passband determination unit 4. That is, the passband determination unit 4 determines the passband of the kerfrenunciation window based on the quefrency component having high intensity in the cepstrum of the side channel information measured by the side channel information measurement unit 2.

  As a band when the peak position in the DSCA result is used as a reference, only the vicinity of the peak is allowed to pass, only the quefrency band near the peak and the peak is allowed to pass, and only the kerfrenciency band near the peak and the peak is allowed to pass. Conceivable.

By performing filtering using the quefrency component obtained from the analysis result as the passband of the kerfrenunciation window, it is possible to realize cepstrum analysis optimal for DSCA, and to perform highly accurate side channel attack resistance evaluation.
(Example)
In the fourth evaluation method described above, DES is mounted on the evaluation board (encryption device 1) capable of performing encryption, and electromagnetic waves leaking from the evaluation board during encryption processing using an oscilloscope (side channel information measurement unit 2) A case where (side channel information) is measured and side channel attack resistance is evaluated using the measured electromagnetic wave waveform will be described as an example.

  First, DES is mounted on the evaluation board, cryptographic processing is performed on a plurality of plaintexts, and leakage electromagnetic waves corresponding to each plaintext are measured.

  FIG. 7 is a diagram showing a waveform of the leaked electromagnetic wave measured by the side channel information measuring unit 2 shown in FIG.

  Subsequently, a cepstrum conversion process is performed on all measured electromagnetic wave waveforms.

  FIG. 8 is a diagram showing a waveform obtained by performing cepstrum conversion processing on the electromagnetic wave waveform shown in FIG.

  A cepstrum conversion process is performed on the electromagnetic wave waveform shown in FIG. 7 to obtain a quefrency versus amplitude waveform as shown in FIG.

  Next, DSCA is performed on the obtained cepstrum. Here, in the DSCA analysis to DES, the S-BOX output in the F function in the last 16 rounds of DES is used as the selection function. The F function has 8 types of S-BOX, each S-BOX has a non-linear table of 6-bit input and 4-bit output, and defines a selection function bit by bit for the output 4 bits of each S-BOX, Thirty-two types of analysis are performed on a total of 32 types of selection functions. In one selection function, 64 types of secret information corresponding to 6 bits that are inputs of each S-BOX are estimated. Here, DSCA is performed using any one of the 32 types of selection functions.

  As a result of performing DSCA, a differential waveform is obtained when correct secret information is estimated.

  FIG. 9 is a diagram showing a differential waveform when correct secret information is estimated as a result of performing DSCA on the waveform shown in FIG.

  Next, a cepstrum component showing a high peak (intensity) in this differential waveform is selected and used as the passband of the kerfrenzy window. Here, as a method for selecting the pass band, 25 to 75, which is around 50 which is the highest peak, was selected as the pass band.

  Subsequently, filtering is performed on the cepstrum shown in FIG. 8 based on the determined passband of the quefrency window. Then, DFT is performed, and an exponent calculation is performed to obtain a spectrum sequence that has been subjected to cepstrum analysis.

  FIG. 10 is a diagram showing a spectrum sequence obtained by performing filtering, DFT, and exponent calculation on the cepstrum shown in FIG. 8 in the determined passband of the quefrency window.

  And DSCA is implemented with respect to the obtained spectrum series. Here, 32 types of analysis are performed on a total of 32 types of selection functions, and 64 types of secret information are estimated for each. Finally, side channel attack resistance is evaluated based on the result of DSCA.

  The above-mentioned “evaluation” is to determine whether or not the cryptographic device 1 can attack the side channel attack by comparing a value obtained as a result of the analysis by the cepstrum analysis unit 3 with a preset condition. Is. For example, when the value obtained as a result of the analysis in the cepstrum analysis unit 3 satisfies a preset condition, it is determined that the encryption device 1 is resistant to the side channel attack.

  As described above, in the present invention, it is possible to evaluate tamper resistance with high accuracy by removing unnecessary signals convolved with side channel information by cepstrum analysis.

  The processing performed by each component provided in the side channel attack resistance evaluation device 6 described above may be performed by a logic circuit that is produced according to the purpose. In addition, a computer program (hereinafter referred to as a program) in which processing contents are described as a procedure is recorded on a recording medium readable by the side channel attack resistance evaluation apparatus 6, and the program recorded on the recording medium is recorded in the side channel attack resistance. It may be read by the evaluation device 6 and executed. The recording medium readable by the side channel attack resistance evaluation apparatus 6 includes a transferable recording medium such as a floppy (registered trademark) disk, a magneto-optical disk, a DVD, and a CD, as well as a built-in side channel attack resistance evaluation apparatus 6. It refers to a memory such as ROM, RAM, HDD, etc. The program recorded on this recording medium is read by a CPU (not shown) provided in the side channel attack resistance evaluation device 6, and the same processing as described above is performed under the control of the CPU. Here, the CPU operates as a computer that executes a program read from a recording medium on which the program is recorded.

DESCRIPTION OF SYMBOLS 1 Encryption apparatus 2 Side channel information measurement part 3 Cepstrum analysis part 4 Passband determination part 5 Differential side channel attack tolerance evaluation part 6 Side channel attack tolerance evaluation apparatus

Claims (7)

A side channel attack resistance evaluation device that analyzes internal processing of encryption and confidential information using side channel information leaked from an encryption device,
A side channel information measurement unit that measures side channel information leaked from the cryptographic device to be evaluated;
A passband determining unit for determining the passband of the kerflen window,
For the side channel information measured by the side channel information measurement unit, a cepstrum analysis unit that performs cepstrum analysis based on the passband of the quefrency window;
A side channel attack resistance evaluation device having a differential side channel attack resistance evaluation unit that determines whether or not the cryptographic device to be evaluated is resistant to a side channel attack based on the side channel information analyzed by the cepstrum analysis unit . In the side channel attack tolerance evaluation apparatus according to claim 1,
The cepstrum analysis unit performs cepstrum conversion of side channel information measured by the side channel information measurement unit,
The differential side channel attack resistance evaluation unit performs differential side channel attack resistance evaluation on the side channel information subjected to the cepstrum conversion. In the side channel attack tolerance evaluation apparatus according to claim 1,
The side-band attack resistance evaluation apparatus, wherein the pass-band determination unit determines a pass band of the kerflens window based on the side channel information measured by the side channel information measurement unit. In the side channel attack tolerance evaluation apparatus according to claim 3,
The sideband attack is characterized in that the passband determination unit determines a passband of the kerfrenunciation window based on a high-level quefrency component in a cepstrum of side channel information measured by the side channel information measurement unit. Resistance evaluation device. In the side channel attack tolerance evaluation apparatus according to claim 1,
The passband determination unit performs differential side channel analysis on the cepstrum of the side channel information measured by the side channel information measurement unit, and uses the quefrency window based on the quefrency component obtained from the analysis result. The side channel attack tolerance evaluation apparatus characterized by determining the passband of the. A side channel attack resistance evaluation method for analyzing encryption internal processing and confidential information using side channel information leaked from a cryptographic device,
Processing to measure side channel information leaked from the cryptographic device to be evaluated;
A process for determining the passband of the kerflen window,
A process of performing cepstrum analysis on the measured side channel information based on the passband of the kerflens window;
A side channel attack resistance evaluation method that performs processing for determining whether or not the cryptographic device to be evaluated is resistant to a side channel attack based on the analyzed side channel information. To the side channel attack resistance evaluation device that analyzes internal processing of encryption and confidential information using side channel information leaked from the encryption device,
Procedure for measuring side channel information leaked from the cryptographic device to be evaluated;
A procedure for determining the passband of the kerf window;
A procedure for performing cepstrum analysis on the measured side channel information based on the passband of the quefrency window;
A program for executing, based on the analyzed side channel information, a procedure for determining whether or not the cryptographic device to be evaluated is resistant to a side channel attack.

Images