Di Li
School of Computer Science, South China Normal University, Guangzhou, China

Zheng Gong
School of Computer Science, South China Normal University, Guangzhou, China

Yufeng Tang
Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China

Chun Li
School of Computer Science, South China Normal University, Guangzhou, China

Keywords: Hardware security, Side-channel analysis, Non-profiling attack, Deep learning, Differentiable Search

Abstract

Deep-learning-based side-channel analysis can effectively break countermeasures such as masking, posing a significant threat to the security of cryptographic devices. In profiling attack scenarios, additional cloned devices are typically required to obtain prior knowledge, which implies the portability problem between profiling and target devices. In contrast, non-profiling attacks ignore the portability by exhaustively testing all possible keys. However, the label information related to the key is unknown, making it difficult to apply deep learning techniques. Since the introduction of Differential Deep Learning Analysis by Timon et al. at CHES 2019, existing approaches can be categorized into unsupervised learning and supervised learning with guessed-key or plaintext labels. Methods based on guessed-key labels have received considerable attention but suffer from significant noise due to incorrect key labels, which limits the model’s ability to distinguish the correct key.To address these issues, this paper proposes a differentiable search for non-profiling side-channel analysis, which is called DS-NSCA. Our method transforms discrete key guesses into continuous probability distributions. By designing a loss function weighted by key probabilities, the approach ensures that the optimal solution corresponds to maximizing the probability of the correct key. This method eliminates the need for an additional key recovery stage by searching for the correct key during training. To further improve search accuracy, we introduce an optimization mechanism based on validation loss gradient-free feedback that dynamically adjusts the key probability distribution after each round, guiding the model’s learning direction. Experimental results on the ASCAD, AES_HD, and CHES_CTF datasets demonstrate that DSNSCA with MLP outperforms existing methods and exhibits robustness against noisebased countermeasures. Furthermore, we demonstrate that integrating convolutional neural network with DS-NSCA can mitigate random delay countermeasures on the AES_RD and ASCAD_RD datasets.