Hi all,

Suppose we have two secret numbers to be fed into P256 point multiplication.

`k1 = 0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff`

Collect its traces, and calculate the average.

Another secret number.

`k2 = 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff`

Similarly, we get its average trace.

Fig2. Average Trace for k2.

Now, I subtract k2’s average trace from k1’s, I get

Fig3. The difference between k1’s and k2’s average traces

We could see some spikes here,

Figure 4.

This confused me. k1, and k2 only differs in MSB; further, in CW305_ECC, this MSB is processed in cycle 42; thus cycle 42 should be the timing where average traces k1 and k2 differs the most, then there should be a large spike at cycle 42, right? If this holds, the next large spike should be at cycle 4246 as CW305_ECC described. Then why are so many spikes in the circled area?

Zoom in the circled area, and label some timings.

Figure 5.

The very beginning cycle, 4400, where these spikes start to show up, does not coincide with 42.

Why isn’t cycle 42 the first timing that comes with the first large spike?

Alan