Power analysis attacks on the AES-128 S-box using differential power analysis (DPA) and correlation power analysis (CPA)
Open accessAbstract
This article demonstrates two fundamental techniques of power analysis, differential power analysis (DPA) and correlation power analysis (CPA), against a modern piece of hardware which is widely available to the public: the Arduino Uno microcontroller. The DPA attack we implement is referred to as the Difference of Means attack while the CPA attack is implemented by building a power model of the device using the Hamming Weight Power Model method. The cryptographic algorithm we have chosen to attack is AES-128. In particular, the AddRoundKey and SubBytes functions of this algorithm are implemented on an Arduino Uno and we demonstrate how the full 16-byte cipher key can be deduced using the two techniques by monitoring the power consumption of the device during cryptographic operations. The results of experimentation find that both forms of attack, DPA and CPA, are viable against the Arduino Uno. However, it was found that CPA produces results which are easier to interpret from an analytical perspective. Thus, our contributions in this article is providing a side-by-side comparison on how applicable these two power analysis attack techniques are along with providing a methodology to enable readers to replicate and learn how one may perform such attacks on their own hardware.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
128-bit AES implemented on Arduino needed only 30 minutes to break by leveraging differential and correlation power analysis.
“e.g.[101] demonstrated that 128-bit AES implemented on Arduino needed only 30 minutes to break by leveraging the differential and correlation power analysis”
From Zero Trust Architecture (ZTA): A Comprehensive Survey (2022) · cites this paper as [101]
The Discussion (§4.3) reports about 30 minutes per full 16-byte key attack and says both DPA and CPA attacks were achievable on the Arduino Uno. However, the implementation described in §3.3 ran only AES-128’s AddRoundKey and SubBytes steps, not the full AES-128 algorithm implied by the citing sentence. (LLM, conf=0.86)
Experimental — accuracy not yet measuredThe simplification in lightweight cryptography comes at the cost of security.
“However, this simplification comes at the cost of security (e.g.[101] demonstrated that 128-bit AES implemented on Arduino needed only 30 minutes to break by leveraging the differential and correlation power analysis).”
From Zero Trust Architecture (ZTA): A Comprehensive Survey (2022) · cites this paper as [101]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Kocher, P. C., Jaffe, J. S., & Jun, B. (1999) · Lecture notes in computer science · doi:10.1007/3-540-48405-1_25 · Cited by 7,569 · see citing works
Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems
Kocher, P. C. (1996) · Lecture notes in computer science · doi:10.1007/3-540-68697-5_9 · Cited by 4,446 · see citing works
On the Importance of Checking Cryptographic Protocols for Faults
Boneh, D., DeMillo, R. A., & Lipton, R. J. (1997) · Lecture notes in computer science · doi:10.1007/3-540-69053-0_4 · Cited by 1,499 · see citing works
Advanced Encryption Standard (AES)
Heron, S. (2009) · Network Security · doi:10.1016/s1353-4858(10)70006-4 · Cited by 1,216 · see citing works
Introduction to differential power analysis
Kocher, P. C., Jaffe, J. S., Jun, B., & Rohatgi, P. (2011) · Journal of Cryptographic Engineering · doi:10.1007/s13389-011-0006-y · Cited by 633 · see citing works
Zhou, Y., & Feng, D. (2005) · Cited by 243 · see citing works
Power and electromagnetic analysis: Improved model, consequences and comparisons
Peeters, E., Standaert, F., & Quisquater, J.-J. (2006) · Integration · doi:10.1016/j.vlsi.2005.12.013 · Cited by 190 · see citing works
Coron, J.-S., Kocher, P. C., & Naccache, D. (2001) · Lecture notes in computer science · doi:10.1007/3-540-45472-1_12 · Cited by 158 · see citing works
Leakage Power Analysis Attacks: A Novel Class of Attacks to Nanometer Cryptographic Circuits
Alioto, M., Giancane, L., Scotti, G., et al. (2009) · IEEE Transactions on Circuits and Systems I Regular Papers · doi:10.1109/tcsi.2009.2019411 · Cited by 132 · see citing works
A Comparative Study of Power Consumption Models for CPA Attack
Mestiri, H., Benhadjyoussef, N., Machhout, M., et al. (2012) · International Journal of Computer Network and Information Security · doi:10.5815/ijcnis.2013.03.03 · Cited by 24 · see citing works
Power-Based Side-Channel Attack for AES Key Extraction on the ATMega328 MicrocontrollerPreprint
Banerjee, U., Ho, L., & Koppula, S. (2022) · arXiv (Cornell University) · doi:10.48550/arxiv.2203.08220 · Cited by 11 · see citing works
Kang, Y. J., Kim, T. Y., Jo, J. B., et al. (2014) · International Journal of Security and Its Applications · doi:10.14257/ijsia.2014.8.2.27 · Cited by 6 · see citing works
Barbero (2014) · doi:10.1016/j · Cited by 1 · see citing works
Flagged first, then by citations
Research works printed but not linked: 2
- [12]12. Pub NF. 197: advanced encryption standard (AES). Fed Inf Process Stand Publ. 2001;197:441- 311.
- [14]14. Brier E, Clavier C, Olivier F. Correlation power analysis with a leakage model. Cryptogr Hardw Embed Syst. 2004;3156:16-29.
Cited by
Sorted by citations
Zero Trust Architecture (ZTA): A Comprehensive Survey
Syed, N. F., Shah, S. W., Shaghaghi, A., Anwar, A., Baig, Z., & Doss, R. (2022) · IEEE Access · doi:10.1109/access.2022.3174679 · Cited by 406 · see citing works
“However, this simplification comes at the cost of security (e.g. [101] demonstrated that 128-bit AES implemented on Arduino needed only 30 minutes to break by leveraging the differential and correlation power analysis).”
BackgroundLightweight cryptography methods
Buchanan, W. J., Li, S., & Asif, R. (2017) · Journal of Cyber Security Technology · doi:10.1080/23742917.2017.1384917 · Cited by 186 · see citing works
Self-citation
- Authors
- Lo, O., Buchanan, W. J., & Carson, D.
- Affiliations
- Edinburgh Napier University (GB)
- Keysight Technologies (United Kingdom) (GB)
- Corresponding author
- Lo, Owen
- Venue
- Journal of Cyber Security Technology
- Publisher
- Informa UK Limited
- Published
- 2016-09-19
- Volume
- 1
- Issue
- 2
- Pages
- 88-107
- ISSN
- 2374-2917 (ISSN-L)
- 2374-2925
- OpenAlex
- W2523737168
- Semantic Scholar
- 89fad09495c408b5d4e4a91afd3e63be60d56f4b
- Cited by
- 106
- References
- 13
- Citations by year
- 2026: 8 · 2025: 13 · 2024: 11 · 2023: 13 · 2022: 17 · 2021: 20 · 2020: 13 · 2019: 5 · 2018: 5 · 2017: 1
- FWCI
- 2.98
- Type
- journal article
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- Journal of Cyber Security Technology (publishedVersion)
- Edinburgh Napier Research Repository (Edinburgh Napier University) (publishedVersion)
- Research Output (Edinburgh Napier University) (submittedVersion)
- Funders
- The Data Lab (E5277)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
- Physical Sciences › Computer Science › Artificial Intelligence › Coding theory and cryptography
- Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
- Keywords
- differential power analysis, correlation power analysis, side-channel attacks, AES-128, S-box, Arduino Uno, key recovery, SubBytes, energy consumption monitoring
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
