Testing resistance of a circuit to a side channel analysis

A system for testing a circuit, the system comprising:

• a measuring device configured to acquire a plurality of value sets, each value set including values of a physical quantity or values of logic signals, the values being linked to activity of a circuit to be tested during execution, by the circuit, of an operation of an operation set of distinct cryptographic operations applied to a same data to be discovered, and
• a processing unit configured to:
• receive the plurality of value sets;
• for each operation of the operation set, and each of the possible values of a part of the data to be discovered, compute results of at least two distinct partial operations of the operation;
• for each value set and each partial operation of the operation corresponding to the value set, select a subset of values in the value set;
• for each selected subset of values, generate an occurrence number set including respective counts of occurrences of each transformed value in a set of transformed values resulting from application of a first surjective function to values of the selected subset of values, the occurrence number set corresponding to the value set and the partial operation of the selected subset of values;
• compute, for each partial operation result, cumulative occurrence number sets, each cumulative occurrence number set being obtained by adding together the occurrence number sets corresponding to the operations of the operation set, which, when applied to a same value or equivalent value of the possible values of the part of the data to be discovered, provide a partial operation result having a same transformed value resulting from application to the partial operation result of a second surjective function;
• combine together the cumulative occurrence number sets corresponding to each partial operation result to obtain combined cumulative occurrence number sets, the combination of the cumulative occurrence number sets being performed as a function of partial operations corresponding to the partial operation results;
• and
• analyze the combined cumulative occurrence number sets to determine the part of the data to be discovered, wherein if the data to be discovered has leaked into the value sets, it is found in the cumulative occurrence number sets corresponding to a value of the part of the data to be discovered.

A non-transitory computer readable medium carrying one or more sequences of instructions, which, when executed by one or more processors, cause the one or more processors to:

• acquire a plurality of value sets, each value set including values of a physical quantity or values of logic signals, the values being linked to activity of a circuit to be tested when the circuit executes an operation of an operation set of distinct cryptographic operations applied to a same data to be discovered;
• for each operation of the operation set, and each of the possible values of a part of the data to be discovered, compute results of at least two distinct partial operations of the operation;
• for each value set and each partial operation of the operation corresponding to the value set, select a subset of values in the value set;
• for each selected subset of values, generate an occurrence number set including respective counts of occurrences of each transformed value in a set of transformed values resulting from application of a first surjective function to values of the selected subset of values, the occurrence number set corresponding to the value set and the partial operation of the selected subset of values;
• compute, by the one or more processors, for each partial operation result, cumulative occurrence number sets, each cumulative occurrence number set being obtained by adding together the occurrence number sets corresponding to the operations of the operation set, which, when applied to a same value or equivalent value of the possible values of the part of the data to be discovered, provide a partial operation result having a same transformed value resulting from application to the partial operation result of a second surjective function;
• combine together the cumulative occurrence number sets corresponding to each partial operation result to obtain combined cumulative occurrence number sets, the combination of the cumulative occurrence number sets being performed as a function of partial operations corresponding to the partial operation results;
• and
• analyze, by the one or more processors, the combined cumulative occurrence number sets to determine the part of the data to be discovered, wherein if the data to be discovered has leaked into the value sets, it is found in the cumulative occurrence number sets corresponding to the value of the part of the data to be discovered.