Machine Learning Power Side-Channel Attack on SNOW-V

TL;DR

The paper addresses the vulnerability of the SNOW-V 5G stream cipher to power-based side-channel attacks on embedded hardware. It implements end-to-end profiling attacks using LDA and FCN on an STM32 platform with ChipWhisperer, supported by TVLA that confirms exploitable leakage. FCN with PCA significantly outperforms traditional CPA+LDA, achieving lower minimum traces to disclosure and enabling multi-bit key recovery with relatively few traces. The findings emphasize the practical risk of ML-driven SCA for SNOW-V and advocate for robust countermeasures such as masking or hiding to strengthen future implementations.

Abstract

This paper demonstrates a power analysis-based Side-Channel Analysis (SCA) attack on the SNOW-V encryption algorithm, which is a 5G mobile communication security standard candidate. Implemented on an STM32 microcontroller, power traces captured with a ChipWhisperer board were analyzed, with Test Vector Leakage Assessment (TVLA) confirming exploitable leakage. Profiling attacks using Linear Discriminant Analysis (LDA) and Fully Connected Neural Networks (FCN) achieved efficient key recovery, with FCN achieving > 5X lower minimum traces to disclosure (MTD) compared to the state-of-the-art Correlational Power Analysis (CPA) assisted with LDA. The results highlight the vulnerability of SNOW-V to machine learning-based SCA and the need for robust countermeasures.

Figures (7)

• Figure 1: Architecture of SNOW-V, comprising: (a) two LFSRs, each consisting of 16 blocks of 16 bits; (b) multiplication units mul_x, $\alpha$, $\beta$, and their respective inverses $\alpha^{-1}$ and $\beta^{-1}$; (c) three 128-bit register blocks; and (d) two AES rounds using a round key of $0^{128}$.
• Figure 2: Internal architecture of $\alpha$, $\beta$, $\alpha^{-1}$, and $\beta^{-1}$ : (a) $\alpha$, $\beta$: these are $\texttt{mul\_x}$ structures with coefficients $0 \ X \ 990f$ and $0 \ X \ c963$ for $\alpha$ and $\beta$ respectively; (b) $\alpha^{-1}$, and $\beta^{-1}$: these are $\texttt{mul\_x\_inverse}$ structures with coefficients $0 \ X \ cc87$ and $0\ X \ e4b1$ for $\alpha^{-1}$ and $\beta^{-1}$, respectively.
• Figure 3: Hardware setup showing workstation, ChipWhisperer capture and target boards, and an STM32 embedded board mounted on the target board and connected via cables. The STM32 microcontroller operates at a clock frequency of 7.37 MHz and sampling rate is four times the clock frequency.
• Figure 4: LDA classification accuracy for recovering bits of the internal state word $A[8]$ across varying data sizes with a 64:16:20 training–validation–testing split. (a) Training accuracy for the last $n$ bits ($n=1,2,4,8$), showing improvement as training traces increase. (b) Test accuracy for the last $n$ bits, demonstrating reliable recovery even for 8-bit cases with increasing traces.
• Figure 5: Accuracy of bit recovery for the internal state word $A[8]$ using a FCN trained on $10^5$ traces, with and without PCA (80:20 train–test split). (a) 1-bit recovery shows negligible PCA impact; (b) 2-bit recovery improves with PCA, especially for PReLU layers; (c) 4-bit recovery drops overall, but PCA gives up to 15% gain; (d) 8-bit recovery falls sharply, with non-PCA models under 10%.